Across enterprise cybersecurity, every major layer has steadily become a sensor. Identity platforms log every access attempt. Endpoint tools trace every running process. Network systems follow every packet across the wire. One layer never got the same treatment, and it happens to be the one attackers exploit most often.
Flavius Plesu, Founder and CEO of OutThink, is blunt about the asymmetry. “Look at the rest of the security stack. Identity, endpoint, network: engineered, instrumented, evidenced. The human layer, involved in 70 to 80% of breaches, is where the stack goes dark. That is an instrument gap, not a judgment gap.”
That distinction, an instrument gap rather than a judgment gap, is the premise OutThink was built on. He founded OutThink in 2019, alongside fellow CISOs who had lived the same problem, out of a conviction that the industry had misdiagnosed it. “The paradox reveals a category error, not bad faith. The industry started from the assumption that human risk is an education problem, and if it is an education problem the job is to deliver content and confirm receipt.”
Training platforms built on that assumption were never really measuring risk, in his account. They were measuring proof of delivery, a job they do well enough to keep auditors satisfied, even as the underlying exposure kept climbing.
Building a New Category
The distinction matters because it rules out an easy fix. Human Risk Management, the category OutThink has spent seven years building, starts from a different question: what does driving secure behavior actually require? A better-designed awareness platform still only pushes material out and records who opened it. What OutThink set out to build instead has to read a specific person’s behavior against live signal from across the security stack, weigh what that behavior means in the moment, and step in before it turns into an incident.
Pulling that off means wiring into EDR, DLP, SIEM, and IAM systems, feeding on continuous behavioral data, and applying psychology and AI built specifically for the problem. None of that bolts onto a content library. It runs on a separate discipline, engineered from a different starting point. The argument is set out at length in Flavius’ guide to driving secure behavior, The End of Security Awareness As We Know It.
Flavius is careful not to let that critique land on the people who ran the old playbook. “The security awareness managers I worked alongside were never the problem. They ran the playbook the industry handed them, and ran it well. They were the first to notice the needle had stopped moving. That was expertise, not failure. The tooling was the failure.”
Where Offense and Defense Diverge?
Artificial intelligence is sharpening both sides of the security equation at once, and Flavius does not think defenders get to choose between sharper tools and deeper behavioral insight on their own timeline. Attackers, in his telling, already made that decision for everyone. “Adversaries have the technology and the behavioral insight. They profile individuals and target them personally, based on role, digital footprint and observable behavior. On offense, the two are already fused. Defense has been playing with only one of them.”
When asked which half of that fusion is the durable advantage, he picks behavioral understanding. It’s simply the harder thing to acquire. “Anyone can buy a model. Nobody can buy years of understanding what makes a specific person, in a specific role, change a specific behavior.”
What AI supplies is scale: a capability that once demanded a small standing team working in shifts, tailoring every message and sustaining a program across an entire workforce, is now something OutThink’s platform can run continuously and largely on its own.
OutThink’s own build order reflects that priority. “We spent years on applied psychology, behavioral science and learning theory before writing a line of code, and we work with Professor Angela Sasse as Chief Scientific Advisor.” Sasse has spent nearly three decades researching usable security at UCL and Ruhr University Bochum, founded the UK’s national research institute for the science of cybersecurity, and is a Fellow of the Royal Academy of Engineering. “Seven years of purpose-built HRM engineering, over 100 enterprise deployments, more than 10 billion behavioral data points.” As Flavius puts it, “The AI is the delivery mechanism. The behavioral science is what gets delivered.”
Beyond the Slide Deck
Compliance rates and incident counts have long stood in for a real answer to how exposed an organization is. Flavius thinks boards ask the wrong question, checking whether a program exists rather than whether human risk is actually falling and whether that decline holds up to scrutiny. Four things, in his view, belong on the agenda instead.
The first is the provenance of the score itself. Almost every HRM vendor now offers one, so what matters is what feeds it. Most vendors build their score from data their own product generates, phishing test results and training completion, which means people are scored on how they performed on tests that same vendor delivered. Flavius has a specific image for why that is a problem: “Scoring people on an environment you designed is like judging how someone drives by watching them park in an empty lot.”
A trustworthy number, in his view, has to draw on evidence from outside the vendor’s own product: signal from EDR, DLP, web filtering, and IAM, the attitudes driving that behavior captured through continuous interaction, what access a person holds, and how often they are actually targeted.
The second is movement. Among organizations that reach that bar, OutThink has tracked human risk scores dropping by around 18 percent, within a range of 10 to 30 percent across its enterprise deployments. The third question is whether the number gets used once it exists, whether a SOC would reach for it while triaging an incident, whether IAM would factor it into conditional access, whether GRC would cite it in a formal risk assessment.
A score nobody downstream acts on, Flavius argues, isn’t really a risk metric at all, just decoration for a slide deck. The fourth is coverage. Phishing susceptibility is only one behavior among several that shape real exposure. Credential habits, data handling, everyday browsing, use of AI tools, and physical security practices all belong on the same scorecard, and a measure built on a single behavior tells you about a habit, not about the person’s overall risk.
Flavius makes a related point: organizations that invest in capability and hope culture follows, against ones that tie security behavior to systems the business already takes seriously, objectives, reviews, recognition, reward. He is skeptical of the industry’s favorite phrase on this front. “Security is everyone’s responsibility” asks employees to be accountable without attaching any real measure to it, and that rarely survives contact with a business.
The missing instrument, in his account, is not organizational but individual: a measure of a person’s security capability across the full range of relevant behavior, visible to the person it describes and something they can actually move. OutThink’s is called CyberQ. Once capability is measurable at the individual level, Flavius argues, it can be developed the way any other professional skill is developed.
Relevance matters too: someone running a networked sensor on a factory floor faces different decisions each shift than an office worker opening email, and material built for neither reads as a compliance exercise. The last piece is posture. Programs that succeed lead with coaching over surveillance, since correction that feels like being watched costs the trust the program depends on.
From Signal to Decision
Collecting behavioral data is the easy part. Flavius is direct about what happens if an organization stops there: “Data alone changes nothing. Two things convert it: prioritization and action.”
Prioritization is a volume problem before anything else. On any given day, a large enterprise throws off more risk signal than a human team could work through in a year, so the real work is machine work, compressing that flood into a short list rather than another pile of unread data.
When asked what a resulting recommendation looks like in practice, Flavius sketches a representative example rather than a real client case: a specific office turns up an outsized share of people flagged in the highest-risk band for data sharing, the contributing factors trace back to stale DLP exceptions and staff routing files through unapproved channels, and the fix is targeted training, an exceptions review, and an approved sharing tool people will actually use.
The direction most programs miss, in his view, runs the other way. “A workforce is not only an audience, it is the best-placed sensor network in the building.” Across a single deployment spanning roughly 20,000 employees, OutThink gathered several thousand observations directly from staff about where friction was actually occurring, many pointing to risks no automated scanner would ever surface.
An engineer flagging that everyone routes around a slow, approved file-sharing tool is not venting. It is, as Flavius puts it, “a control failure reported by the only person positioned to see it.”
What reaches an executive should never be the short list itself. Flavius says it is “the trend and the trade-off,” meaning whether exposure is falling, where it concentrates, and what it would cost to move it. He places the furthest edge of that logic at full autonomy, human risk feeding controls with no person in the loop at all, and notes that fewer than one in a thousand organizations are even experimenting there yet.
The Maturity Model
The HRM Maturity Model frames organizational progress as a four-level climb: Level 1 (Reactive), Level 2 (Self-Adapting), Level 3 (Proactive), and Level 4 (Predictive). Gartner research puts 72 percent of organizations at what the model calls Level 1, and the company finds the more revealing number in what happens to the rest.
Almost none of the remaining 28 percent make it to Level 2. Effort is rarely the constraint, Flavius says. The platforms they bought were engineered to excel at Level 1 and nowhere past it, which is why click rates plateau around 7 to 8 percent even as the incidents traceable to human error keep rising regardless.
The step to Level 2 is where behavior actually starts to shift, and OutThink’s work across more than 100 enterprise deployments points to four jobs of driving secure behavior that have to operate together rather than any one alone: Motivate, Educate, Activate, Correct.
Flavius is precise about why partial adoption fails. “Motivate people and teach them nothing specific and it is gone in three weeks. Teach them well but never correct in the moment and it stays knowledge. Two out of four does not get you halfway, it gets you a system with a hole in it.”
Level 3 is where human risk becomes a number defensible in front of a board, and Level 4 is the point where that same number begins to trigger controls without anyone signing off. The order cannot be skipped, Flavius insists: “Level 2 earns permission from the workforce and Level 3 earns permission from the business.”
Organizations that jump ahead tend to hit the same wall, he warns: “a VP blocked mid-quarter, a board member locked out of something critical, and the program quietly derailed inside a month.” No organization needs to reach Level 4 to see a return. Each level pays for itself on its own terms.
Governing the Agents
Flavius frames the next era of the industry as two shifts happening at once. The first is that security controls will finally account for the person behind them, rather than treating a constantly targeted finance director the same as someone attackers have never noticed. Closing that gap promises less friction as much as tighter security: fewer access tickets, fewer manual permission changes, a help desk that isn’t purely a ticket line anymore.
The second shift is about who gets governed rather than what. OutThink is building toward asking the same behavioral question of software that it already asks of people. “Most enterprises will soon be running thousands of software agents alongside thousands of employees.
Gartner puts 40% of enterprise applications integrating AI agents by the end of 2027. Each holds credentials, calls tools, inherits permissions from whoever delegated to it, and produces output people act on without much scrutiny.”
Trust itself gets redefined right there, in Flavius’s account. Decades of security practice went into learning to verify identity. Agents complicate a different axis of the problem entirely. “The agent is who it claims to be. Whether it should have done what it just did is a different question, and not one the current tooling answers.”
The instruments built to watch agents so far, runtime guardrails, non-human identity governance platforms, agent inventories, all sit one layer too shallow. They can confirm an agent touched a database at an odd hour. They cannot judge whether that made sense, since judgment depends on knowing who the agent was working for.
OutThink’s answer is to extend the same architecture it built for people. “Our position is that agents need what we give people: a profile, a baseline, drift detection, a risk score, and an intervention when behavior moves outside agreed limits. Same logic, because it is the same problem.”
Flavius adds a warning for leaders: delegating a task to an agent does not delegate away accountability for it, so an executive who answers for a team will increasingly answer for that team’s agents too. He extends the same warning to the market at large. “You cannot retrofit agent governance onto a stack that never learned to model human behavior in the first place.”
Whoever ends up governing agents well by the end of the decade will be whoever already built that behavioral groundwork for people, and that sequencing is why OutThink is building it this early. The integration layer is live today across identity, DLP, email security, endpoint and web gateways. The capabilities that depend on it, risk quantification trusted enough to move someone’s access, letting people repair their own standing without going through the SOC, and behavioral governance for agents, are still being built, because the earlier stages of the maturity climb decide whether Level 4 is even reachable.
Earning the Boardroom Seat
Cybersecurity has migrated into the boardroom, but Flavius does not think CISOs earn a seat there simply by getting better at security operations. “They get invited by bringing the board something it can actually use.” When a board asks whether a competitor’s breach, the kind that started with one compromised employee, could happen to their own organization, activity data cannot answer that, and neither can a click rate. The CISO ends up talking around the question, and the gap is in the evidence available, not the skill of the person presenting it. “I’ve lived that journey as an ex-CISO,” Flavius says.
He lays out three moves that change the dynamic. The first is bringing risk instead of activity, a quantified figure with a defensible methodology and visible movement over time, the language a board already uses for every other risk on its register.
The second is attaching real business numbers while being explicit about where modeling starts, since “overclaiming costs more credibility than underclaiming costs influence.”
The third is convening rather than deploying alone: the scoring and access work that matters most cuts across HR, Legal, and the data protection office, and a CISO who brings those functions to one table is already acting as a business leader.
That repositioning connects directly to value creation. A workforce that handles data responsibly can be trusted with broader access and fewer restrictions, and lower measured risk is something a board already knows how to price as freedom regained.
Between securities disclosure rules and frameworks like DORA and NIS2, human risk has already turned into something boards answer to shareholders for. The seat is there. What earns it is evidence, not ambition.
OutThink treats regulation and agility as allies rather than rivals. “Governance is what makes the powerful capabilities deployable in the first place.” A visible, improvable security score is achievable today, he notes, but tying that score to appraisals or bonus criteria is a different undertaking, touching employment policy, data protection, and often works council consultation in Europe. Building the capability is the easy part of that equation. The organizational agreement that makes it defensible can take months, and belongs to someone outside the security team.
That is why OutThink builds toward supervised rollout rather than full autonomy from day one, starting with the platform proposing and flagging while a person decides what actually gets enforced.
Confident organizations later automate lower-stakes calls first, an extra login prompt or a quick device check, long before anything touches a system that matters, and how far it goes stays their decision, never OutThink’s. Transparency has nothing to do with a policy document, in Flavius’s telling. “A measure people can inspect survives scrutiny. One that simply happens to them does not.” He sums up the regulatory climate as an “accelerant rather than a brake.”
Why OutThink Exists?
OutThink’s founding traces back to two moments in Flavius’s life, one in childhood and one in a boardroom. He grew up in Romania, where proof that a family owned its home was once a single piece of paper kept in a drawer. “At some point that proof moved into a database.
When that database was attacked this year, the vulnerabilities were already known and the warnings already written down. What was missing was the thing that turns a warning into changed behavior.” The company he later built exists to supply that missing thing.
The boardroom moment came years later, and it is the one Flavius points to directly: “The formative experience, though, was being the CISO who could not answer his own board on human risk.” He had been working on the secure behavior management problem since 2013, when he wrote his MSc thesis on human factors in cybersecurity as part of a GCHQ-certified MSc in Information Security at Royal Holloway, before going on to lead security at scale – most recently as CISO at Bank of Ireland. Across those roles he deployed or tested every human-layer tool the market offered.
“I ran the campaigns. I tracked the metrics. I reported to the board with charts that looked reassuring. Privately, I knew none of it was working. That gap between what I presented and what I believed is what led to OutThink.”
Three convictions came out of that gap and still shape how the company builds today. OutThink sits with practitioners before building anything, a sequencing choice that meant years immersed in the psychology and science of behavior change before any code was written, which Flavius calls the single most important decision the company made. It names problems honestly, including the parts that cut against its own commercial interests. And it never blames the user. “People are the greatest asset in security, not the weakest link. A platform built on the opposite assumption will police instead of coach, and it will fail.”
The Contrarian Bet
Asked what conviction he held that others underestimated, Flavius answers without hesitation: “That human risk is a data problem, not a content problem.” That conviction is the thesis OutThink was built on.
When OutThink started in 2019, the prevailing industry answer to the human layer amounted to sharper content, sleeker training videos and more convincing phishing simulations built on the assumption that good enough material would eventually change behavior on its own.
OutThink was built on the opposite bet. Knowing who a person actually was, what motivated them, and the threats actually being pointed at them mattered more than any script, and without that layer of understanding, in Flavius’s words, “the best video in the world is still a broadcast.”
Holding that position was unpopular, because it demanded a far harder product than the market wanted to build: years of engineering across behavioral data infrastructure, applied psychology, and AI, work that would remain largely invisible to a buyer until the value finally became legible.
What that bet cost Flavius personally, he says, is patience he did not naturally possess. Building out a category this way, one capability at a stretch, is excruciating, and the hardest part was never the engineering.
The hardest part was watching a security leader walk away from a conversation still thinking, how is that different. He feels that moment every time, precisely because he can see what the platform is capable of.
“Being right early is not the same as being understood, and the work of being understood is my job, not the industry’s.” That work, at this point, is inseparable from OutThink’s own: the company’s whole architecture is still the argument for the thesis he started with.
The framework and figures in this piece draw on The End of Security Awareness As We Know It, Flavius Plesu’s practitioner’s guide to driving secure behavior and the Human Risk Management Maturity Model, published by OutThink in July 2026.
Also Read :- CIO Times Magazine for More Information
