Highlights
Training has commoditized: high renewals, falling contract values, and no pricing leverage for anyone
Content cost is falling toward zero, so revenue moves to behavior data
Compliance and the SOC study the same humans and share almost nothing
The next wave of buyers waits for proof that migrating is safe
A category priced like a checkbox
Security awareness is the rare software category where everyone agrees on the diagnosis. An analyst who covers it told me this week that traditional training has commoditized: renewals are high, compliance gets satisfied, CISOs value it, and nobody has pricing leverage. Incumbents are in renewal mode, and average contract values are drifting down. The market is cheap and behaves like a checkbox because, for most buyers, it is one.
The consensus conclusion is that the category is mature and the job now is to defend share. I think that gets it backwards. A category this commoditized is not mature. It is a category whose old value engine has stalled and whose new one has not yet taken over.
Here is the thesis: three forces are rebuilding human risk from the data up, and all three point away from training as the product.
Three forces, one direction
The first is the collapse of content cost. The old model sold the platform cheaply and upsold content across multi-year deals. Models now produce training, video, and voice at a cost that falls toward zero, and no one should bet against the rate. When the upsell turns free, revenue has to come from somewhere else. It comes from knowing how people actually behave.
The second is the budget firewall. Awareness sits under governance and compliance. Insider risk sits in the security operations center, which has the bigger budget and the bigger team. Few organizations combine the two today, and the analyst expects them to converge over time. Behavior is the only thing that can cross the wall, because a click, a report, and a risky access pattern are one fact seen from two desks.
The third is the unit of risk. For two decades the unit was one person, one training, one simulation. People now delegate to agents that read their email, write their code, and act with their credentials, so one risky employee may command a swarm. Testing the person while ignoring what the person has launched covers a shrinking slice of the exposure. Every agent has a human behind it, and that human's behavior decides how much trust the agent inherits.
What sets the speed
If the direction is clear, why is the category slow? Because of the buyer. By the analyst's account, most CISOs now know next-generation behavior management exists and shrug: probably the future, renew the incumbent for one more year. The early adopters have already switched. The next wave is not waiting for better technology. It is waiting for proof that moving is safe.
So the pace of the category will be set by trust, not capability, and the winners will make migration feel like a ladder rather than a leap.
That is where this lands. Human risk is moving from teaching people to modeling behavior across people and the agents they command. Training stays as the floor. The product is the model of how humans behave, and whoever holds it can answer the compliance team, the SOC, and the board from one record. That is the human column we are building Cimento to own.
Key Takeways
Treat training as the floor of your program, not the product you are buying.
Ask whether your behavior data can be read by the SOC, not just by compliance.
Extend your human risk model to the agents your employees launch.
Judge vendors by how safely they let you migrate, not only by feature lists.
Plan your roadmap from training to behavior in rungs you can approve one at a time.
