Highlights
The risk map is a prior: most programs treat guesses about departments as settled fact.
The least-watched team failed most: the department nobody worried about was the real exposure.
A bad measurement feels like evidence: one misconfigured campaign inflated failure rates until it was caught.
The org chart is a guess
Every security team carries a risk map in its head. Finance is dangerous because it moves money. Engineering is dangerous because it holds keys. Support is dangerous because it opens everything from everyone. The map feels so settled that whole programs are built on it: heavier training here, tougher simulations there, a lighter touch for the departments nobody loses sleep over.
This week, at the end of a proof of concept, a security leader told me something that should bother all of us. The departments they expected to be risky turned out to be fine. The department they had barely thought about was where people actually failed.
Why the prior breaks
My claim is simple: a department is a label, and risk lives in behavior. We assign risk by what a team can reach, but attackers choose targets by what a team will do. Those are two different measurements, and the gap between them is where breaches live.
Think of the map as an assumed orbit. It holds right up until someone measures the actual path. Teams assumed to circle safely around caution drift, because their workload, their incentives, and their tooling pull them somewhere else. A team that is never targeted in testing, never trained hard, and never talked to by its manager has no reason to build the reflex.
The low-concern department is also the one where nobody checks. Attention is a form of protection, and ignoring a team is a decision with a cost that only shows up later, and usually on the worst possible day.
Measure before you assign
The fix is not to swap one assumption for another. The fix is to stop assuming. Run the same realistic simulation across every group, at the same difficulty, for one full cycle, and read the result before you spend an hour of training time.
Then protect the measurement itself. In that same proof of concept, one campaign had been configured to count an email open as a failure, which inflated the failure rate until someone noticed. A bad measurement is worse than none, because it looks like evidence and it points your budget in the wrong direction with total confidence.
Another security leader described a habit that attacks the problem from the other side: sending lures themed on tools the company does not even use, specifically to catch people who click without thinking. Both ideas share one principle. Test the behavior, not the plausibility of the story.
Human risk is a distribution
Human risk is not a property of a department. It is a distribution across people, shaped by role, context, workload, and recent history, and it moves every month. A program that treats it as fixed will always be training last quarter's problem.
The useful claim is a narrow one: you cannot allocate attention well until you have measured where the failures are. Cimento exists to measure that distribution per person and keep measuring it, so the map is drawn from evidence instead of habit. Start by running your assumptions through a real test, and let the least-suspected team surprise you.
Key Takeways
Run one identical simulation across every department before changing any training allocation.
Audit your campaign configuration so that a mislabeled failure condition cannot distort the results.
Treat your least-watched team as a hypothesis to test, not a safe default.
Re-measure each cycle, because the distribution of risk moves.
