The Interpretation Gap

Something Just Changed

Security teams have spent years chasing visibility. More signals, more dashboards, more alerts. And for most of the last decade, that was the right fight. You can't protect what you can't see. But we've crossed a threshold, and most of the industry hasn't caught up to what that means.

A compromised account can do things it's allowed to do. A rogue AI agent can follow the rules it was given. A bad outcome can look completely normal in the logs. That means the question is no longer just "Can we see what happened?" but "Can we understand the intent, the context, and the risk behind behavior that appears legitimate?"

Three forces are converging right now that make this urgent:

AI agents are creating a new attack surface that expands faster than security teams can monitor. Detection platforms are ingesting more signals than ever. And the operational work of running a security awareness program is being automated out from under the people who do it.

Everyone is building faster detection. Almost nobody is building interpretation.

What the Market Is Actually Building

The human risk management space has moved fast. If you haven't looked at it closely in six months, you're behind. Here's what's shipping right now, and what each approach gets right and wrong.

Every one of these companies is automating a piece of what the security awareness practitioner does today. And none of them are building tools for that practitioner. They're building tools that go around them.

Five Things Nobody Is Solving

1. Organizational Context

Every platform collects signals from systems. None of them collect signals from the organization itself. Culture, politics, informal authority structures, project dynamics, relationship networks, strategic priorities -- this is the context that gives behavioral signals meaning.

When someone accesses a system they're allowed to access, the only way to flag it as suspicious is knowing it contradicts their current project scope, their team's priorities, or their relationship graph. No amount of behavioral ML generates that context from login timestamps and API calls.

2. The Interpretation Layer

The output of every HRM platform in 2026 is a risk score, a confidence number, and a recommended action. The CISO or analyst must still interpret what that means in their specific context. Is a 78 risk score bad? Compared to what? Does this anomaly matter given what's happening in the business right now?

The platforms generate answers. Nobody is helping organizations develop the judgment to evaluate those answers.

3. Agent Intent Delegation Chains

When Agent A delegates to Agent B which calls Agent C, intent degrades at every hop. It's a telephone game. Current platforms monitor individual agents and measure blast radius. But blast radius is a static metric.

The real question: when an agent acts on behalf of a human, through a chain of delegated authority, does the resulting action align with what the organization actually intended? Agents don't have intent. They have instructions. The security model for something with instructions is fundamentally different from the security model for something with intent. Nobody in the market is making this distinction cleanly.

4. Measurement Validity

Click rates go down because people learn to spot the simulation, not necessarily because they develop security judgment. Culture surveys measure what people say they believe, not what they actually believe. Intervention response rates measure behavior within the platform, not whether behavior changed in unmonitored contexts.

5. The AI-Watching-AI Problem

We now have AI making risk decisions about other AIs. ML models monitoring ML agent behavior. AI agents managing human risk from AI agents. At some point this recursion needs a human trust anchor. But humans can't operate at agent speed.

The answer isn't "put a human in the loop for every decision." It's giving humans a structured framework for judgment that lets them set the parameters, validate the reasoning, and intervene at the right abstraction level. That framework doesn't exist yet in any commercial product.

What Happens to the People Doing This Work

This is the part nobody in the vendor community wants to talk about directly, so I will.

The operational work of running a security awareness program -- selecting phishing templates, scheduling simulations, assigning training, tracking completion, pulling reports -- is being automated right now. Not "will be automated." AIDA Orchestration shipped in February. The content creation side (training materials, awareness campaigns, internal newsletters) is next. AI content generation is a core feature of every platform in 2026.

That work represents the majority of what most security awareness practitioners do day-to-day. Especially at organizations that are still in the compliance-driven, completion-rate-focused stage of program maturity. Which, according to Forrester's own framework, is most organizations.

So what happens?

What Survives Across All Three Scenarios

Regardless of which future plays out, certain capabilities remain valuable. Organizational psychology -- not as academic theory but as practical navigation of how decisions actually get made. Data interpretation -- not pulling reports (that's automated) but the judgment to say "this metric is improving but the underlying behavior hasn't changed, here's why." Stakeholder translation -- reframing a risk finding in language that HR, Legal, or the CFO will act on. Strategic program design -- accounting for culture, politics, and constraints that no platform models.

Those are all skills that are hardest to develop, hardest to assess, and hardest to hire for. They're also the skills that no certification program teaches and no vendor platform develops.

The Behavioral Science Question

There's a counterargument to everything I've said about the practitioner's value, and it deserves a fair hearing.

The most sophisticated platforms in the market have built their entire approach on genuine behavioral science. Databases mapping 70+ security behaviors to real-world risks. Eight measurement dimensions scientifically validated as predictors of human cyber risk. AI advisors built on decades of research in behavioral economics and cyberpsychology. Culture assessment that goes beyond training completion to measure how people think, feel, and approach security.

If this works as designed, it means the "understanding why people do what they do" layer can be systematized and measured by a platform. The behavioral science expertise gets encoded into the product, not carried by the individual running the program.

That's the strongest argument for the practitioner role disappearing entirely.

Where It Breaks Down

Every behavior these platforms track is behavior they can observe through their instruments. The most consequential human risk behaviors often happen where no platform has visibility: the hallway conversation where someone shares a credential, the decision to plug in a found USB drive, the moment someone decides to trust a caller who sounds like their CEO.

Their culture surveys have the same limitation every survey has. Nobody tells the security culture assessment "I think password policies are pointless and I reuse passwords everywhere." They tell the survey what they know the right answer is. Social desirability bias is real and it's strongest in exactly the domain these platforms measure.

And behavioral models trained on known patterns struggle with genuinely novel situations. The next social engineering approach won't look like anything in the training data. What catches it isn't pattern recognition. It's skepticism and judgment -- the kind that comes from understanding organizational context, not from a behavioral database.

So What Do We Do With This

I don't have a clean answer. I think anyone who does is selling something. But I do have a few convictions coming out of this analysis.

The interpretation gap is real and it's growing. Every dollar spent on detection without a corresponding investment in judgment makes the gap wider. The first wave of fully autonomous awareness programs will produce spectacular results on their own metrics and a false sense of security in the organizations running them.

The practitioner's value was never the dashboard work. It was always the organizational navigation, the stakeholder relationships, the judgment calls. Most practitioners never got to develop those skills because they were buried in campaign operations. Automation is both the threat and the opportunity: it removes the work that was holding them back, but it also removes the justification most organizations had for the role.

Nobody is building the organizational context layer. Not the behavioral science platforms, not the AI-native entrants, not the autonomous orchestration engines. Every one of them stops at the boundary of what their instruments can see. The organization itself -- how it actually works, not how the org chart says it works -- remains invisible to the platforms that are supposed to protect it.

The "AI watching AI" recursion needs a trust anchor. And that anchor is structured human judgment -- frameworks that let humans set parameters, validate reasoning, and intervene at the right level of abstraction. The teams that build those frameworks will navigate this era. The teams that outsource judgment entirely to automated systems will discover what it means to optimize for the metric instead of the outcome.

That requires interpretation. And interpretation requires context, judgment, and organizational understanding that no platform has automated yet.

The question is whether the industry will invest in building that capability -- or whether it will keep buying faster dashboards and calling it progress.