New research shows why security teams must track where workforce risk moves and respond to its underlying cause
AUSTIN, TX / ACCESS Newswire / September 29, 2026 / Living Security, the global leader in Human Risk Management (HRM), today highlighted new findings from The Moving Target: 2026 State of Human Risk. In the workforce measured, the riskiest 10% of users accounted for 98% of data loss risk and 96% of malware and endpoint risk in their respective categories.
The findings deepen a pattern identified in Living Security's previous research: 73% of risky behavior traced to the riskiest 10% of the workforce. But concentration does not mean security teams can identify one group and consider the job done. Nearly two-thirds of the employees in this year's riskiest 10% were not in that group in the prior comparison period.
"Human risk has a clear concentration point, but it is a moving target," said Ashley Rose, CEO and Co-Founder of Living Security. "As people change roles, gain access and encounter new threats, their exposure changes too. Security teams need a current view of risk and the ability to act on what is driving it."
Concentrated Risk Calls for Different Responses
Data loss and endpoint risk are both highly concentrated, but they are not necessarily driven by the same employees. Security teams need to examine each source of exposure separately. A pattern of risky behavior may call for targeted guidance, while access or device exposure may require a change to security controls.
The people driving risk also change over time. A priority list built from last year's data can miss employees whose risk has since increased. The report points to a continuous approach: find where risk sits today, act on its cause and keep watching for where it moves next.
The Moving Target draws on seven years of de-identified telemetry from the Living Security Platform, covering more than 100 organizations, nearly five million verified workforce identities and more than 55 million risk-signal detections. For the longitudinal analysis, Living Security followed the same employees across two years to examine how their risk changed.
Ashley Rose will explore the findings and what they mean for security teams in the live webinar, Human Risk Is a Moving Target: What the 2026 Data Reveals, on October 22 at 12 p.m. CT. The session will cover how the highest-risk group changes over time and how teams can identify emerging risk and take targeted action.
Register for the webinar: https://www.livingsecurity.com/human-risk-is-a-moving-target
Download the report: The Moving Target: 2026 State of Human Risk
About the Research
The Moving Target: 2026 State of Human Risk analyzes de-identified telemetry from organizations using the Living Security Platform. Risk signals are weighted by their impact on the Human Risk Index. The findings describe measured workforce risk, not confirmed data loss or malware incidents. The report includes its methodology and limitations.
About Living Security
Living Security is the global leader in Human Risk Management (HRM), helping organizations identify, measure and reduce human cyber risk across humans and AI agents. Its AI-native Human Risk Management platform combines behavioral, identity and threat intelligence to predict risk, guide response and prevent cyber incidents before they occur. By connecting security data to measurable business outcomes, Living Security enables organizations to continuously reduce workforce risk while strengthening organizational resilience.
Media Contact: media@livingsecurity.com
SOURCE: Living Security
View the original press release on ACCESS Newswire:
https://www.accessnewswire.com/newsroom/en/computers-technology-and-internet/living-securitys-2026-state-of-human-risk-report-finds-98-of-data-1228511
