TL;DR SUMMARY: Secure Behaviour Management brings together human risk management, behavioural science and cyber security into a more people-centred approach to understanding and supporting the behaviours that shape security every day.
A new term for an old problem?
Cyber security has never been purely a technical problem. People have always been part of the picture, whether they’re opening an email, handling sensitive information, approving a payment, sharing a document or deciding whether something feels safe enough to click. Yet the language surrounding cyber security has traditionally been dominated by technology, controls and threats. Human behaviour has often appeared further down the list, discussed through concepts such as security awareness, the human element or, more recently, human risk management.
That vocabulary is changing, with Secure Behaviour Management emerging as a new way of describing a more active, people-centred approach to cyber security. Gartner has begun using Secure Behaviour Management, or SBM, as a category term for solutions focused on improving and managing security-related behaviour, reflecting a broader shift towards measuring and influencing what people actually do within an organisation.
At first glance, it might sound like another addition to an already crowded cyber security lexicon. There’s something more useful in the idea, particularly when it’s considered alongside the growing focus on human risk and behavioural science.
From human risk to human behaviour
Human Risk Management has helped shift the conversation around cyber security by recognising that people’s actions can create security exposure, often unintentionally. It gives organisations a framework for identifying, understanding and managing those risks, bringing greater attention to the human dimension of cyber security.
Secure Behaviour Management builds on that thinking by putting behaviour itself closer to the centre of the conversation; What is someone doing? What’s happening around them? What information do they have available? What might be influencing their decision at that particular moment?
Those questions open up a more behavioural way of approaching human risk. A person might know that an unexpected link could be dangerous and still click it when they’re distracted, under pressure or trying to complete a task quickly. Their knowledge is still there, while the context surrounding the decision has changed. Understanding that context creates more opportunities to support safer behaviour.
Why the wording matters
Language shapes how organisations frame problems, and the terminology used around human behaviour can influence the solutions that follow.
The move towards Secure Behaviour Management reflects a growing interest in understanding behaviour as something that can be measured, influenced and supported within the wider security environment. It gives organisations a way to talk about what people actually do, the conditions surrounding those behaviours and the interventions that can help them make more secure decisions.
That perspective aligns closely with established behavioural science. People’s actions are influenced by their environment, the information available to them, the effort required to take an action and the pressures they’re experiencing at the time.
Cyber security operates within that same environment.
A person might understand a security policy perfectly well and still make a different decision when they’re under time pressure, distracted by another task or faced with a process that feels difficult to navigate. Research into cyber security behaviour has repeatedly highlighted the influence of workplace context and time pressure on how people make security decisions.
From awareness to action
Security awareness has an important role in helping people understand threats and recognise potentially risky situations. Training can introduce concepts, policies can establish expectations and simulated exercises can give people opportunities to practise.
The challenge comes when that knowledge needs to translate into behaviour.
Someone can understand the risks associated with phishing and still interact with a convincing message. Someone can know that sensitive information needs to be protected and still share it in a way that creates exposure. Behaviour is shaped by far more than knowledge alone, particularly when a decision is being made quickly. This is where behavioural science adds an important dimension.
Small changes to the environment around a decision can influence what people notice and how they respond. A well-timed prompt can bring attention back to a potentially risky action. A short piece of information can help someone interpret an unfamiliar situation. A contextual intervention can create enough space for someone to think before acting.
Secure Behaviour Management gives these ideas a place within the wider cyber security conversation, connecting behavioural insight with practical interventions and measurable security outcomes.
The role of context
Context is central to this way of thinking. The same person can behave differently at different points in the day. Their workload, attention, familiarity with a task and the situation surrounding a decision can all influence what they do.
The National Cyber Security Centre’s guidance on cyber security culture makes a similar point, highlighting the number of security encounters people navigate throughout the working day alongside the other demands of their jobs. It also recommends ongoing feedback and testing, with an emphasis on understanding how people behave and why. That makes contextual intervention particularly interesting.
A message telling everyone to be vigilant has limited value when someone is already dealing with a specific situation. A contextual intervention can respond to what is happening instead, providing support that relates directly to the action in front of them.
This is one of the principles behind Redflags. Redflags uses behavioural nudges to respond to the context and behaviour of the individual using a device. Rather than relying solely on information delivered in advance, it can provide support at the point where a security-relevant decision is taking place.
The person remains at the centre of the decision. They’re given an opportunity to recognise what’s happening, consider the potential risk and decide how to proceed, while the intervention becomes part of the working environment.
Secure behaviour as an ongoing practice
This also changes how we think about security behaviour over time.
People encounter new systems, new threats, new working practices and new situations throughout their working lives. Security behaviour therefore develops through repeated experiences, the environments people work within and the support available when decisions are being made.
That makes Secure Behaviour Management closely connected to the idea of continuous improvement.
It can sit alongside training, awareness, technical controls and human risk management, connecting those different layers to the everyday decisions people make. Training can establish knowledge, policies can establish expectations, technical controls can create boundaries and behavioural interventions can support people when they encounter situations that require judgement.
The NCSC’s current cyber security culture guidance similarly emphasises continuous improvement and learning, with organisations encouraged to create conditions that help people carry out secure behaviours as part of their normal work.
A useful evolution in the cyber security lexicon
There’s no shortage of terminology in cyber security, and a new phrase earns its place when it gives organisations a clearer way to understand an existing challenge. Secure Behaviour Management has the potential to provide that clarity. Its underlying principles have been developing for years. Behavioural science has long explored how people make decisions. Security teams have been working on human risk, awareness and behaviour for decades. Organisations have used training, policies and technical controls to influence how people interact with technology.
The evolution lies in bringing those strands into a more coherent way of thinking about security behaviour. It places people alongside technology as an active part of the security environment, while recognising that behaviour is shaped by context, attention, capability and the conditions surrounding a decision.
Human Risk Management has helped establish the importance of understanding the human dimension of cyber security. Secure Behaviour Management builds on that foundation by giving greater emphasis to the behaviours organisations want to understand, support and improve.
For Redflags, that creates a natural connection between behavioural science and practical cyber security. Context-aware nudges can support people at the point of decision, while behavioural insight can help organisations understand where and why those decisions are happening.
The term may be new to some parts of the cyber security world, but the thinking behind it has deep roots. What’s changing is the vocabulary, the visibility of human behaviour within security strategy and the growing opportunity to design security around the way people actually work.
Key takeaways
- Secure Behaviour Management puts behaviour at the centre. It builds on Human Risk Management by focusing more closely on what people actually do and the conditions influencing those decisions.
- Knowledge doesn’t always translate into action. People can understand security principles and still behave differently when they’re distracted, under pressure or working quickly.
- Context can change the outcome. Understanding what’s happening around a decision creates opportunities to provide relevant support rather than relying on generic security reminders.
- Behaviour is something organisations can support over time. Secure Behaviour Management brings together behavioural science, training, technical controls and contextual interventions to make secure behaviour part of everyday work.
