Roadmaps Security roadmaps Governance, risk, compliance and audit
Change what people do, not just what they know: awareness programmes, phishing simulation done well, security culture, behaviour design and insider risk.
Estimated time: 14–26 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Social engineering works on trust, urgency and habit. Learn the common attacks on people and why knowing about them is not enough to stop them.
People who know the rules still break them under pressure. Target specific behaviours, such as reporting suspicious email, rather than general awareness.
Phishing, passwords and MFA, device and data handling, reporting incidents, and working remotely. Cover few topics well rather than many badly.
Short, concrete, friendly and relevant beats long, abstract and scary. Learn to write and present for people who have other jobs.
Onboarding, annual refreshers, role-based sessions and just-in-time nudges each have a place. Match the format to the behaviour and the audience.
The most valuable behaviour is reporting a mistake or a suspicious message quickly. Thank reporters, never punish, and show what happened next.
Set goals, pick target behaviours, plan the year, choose channels and define how you will measure. A programme is more than a training platform.
Simulations teach recognition and reporting when they are realistic, frequent, low-stakes and followed by instant feedback. Done badly they breed resentment.
Avoid cruel lures, never shame individuals, and be open about the programme. Trust lost in one bad campaign takes years to rebuild.
Finance, developers, executives and administrators face different threats. Give each group training about their own risks.
Report rates, time to report, repeat clickers, password manager adoption and real incidents tell you more than completion rates. Measure behaviour.
Volunteers in each team spread messages, answer questions and feed back what is not working. They multiply a small team's reach.
Culture is what people do when nobody is checking. Measure it, understand the pressures that work against security, and change the environment, not just the people.
Make the secure behaviour easy, timely and rewarded. Defaults, prompts and friction often beat training. Work with the teams that design systems.
Combine simulation, identity, email and incident data to see which groups carry the most human risk and target them. Treat people's data with care.
Negligent and malicious insiders both cause harm. A fair insider risk programme combines culture, access control, monitoring and a humane process.
Leaders are targeted most and trained least. Give them tailored briefings, protect their accounts and brief their assistants too.
Deepfake voice and video, perfect phishing and automated pretexting change what people can be expected to spot. Update training and add verification steps.
Set the long-term vision for security culture, win leadership sponsorship and align with HR, communications and the business.
Show leadership the human risk trend, the behaviours improving, and where the environment still works against people. Numbers and stories together.
Much awareness practice is folklore. Follow the research on what changes behaviour and drop what does not work, however traditional.
Most incidents involve a person: a click, a reused password, a bypassed process. Human risk management works on the behaviours behind those incidents, through awareness, training, well-designed systems and a culture where people report mistakes early.
The field has moved on from annual slideshows. Modern programmes target specific behaviours, measure them, use simulations ethically, and work with the people who design systems so that the secure choice is the easy one. It needs communication skills, some psychology and an honest view of what training can and cannot fix.
Phishing and social engineering remain the top ways in, and regulators require training. Organisations need people who can measurably reduce human risk without blaming or boring their colleagues.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact