OutThink Recognized in Gartner's Secure Behavior Management Research

Gartner has published new research on the shift away from traditional security awareness training: "Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management," by William Candrick and Alex Michaels (22 September 2026). OutThink is named a Representative Vendor in the report's list of secure behavior management (SBM) providers.

The report's argument will sound familiar to anyone who has read our manifesto, The End of Security Awareness As We Know It. Gartner's own numbers make the case for us: in its 2026 CISO Role Survey of 297 security leaders across North America, EMEA, APAC and Latin America, conducted between March and May 2026, 81% of organizations still had at least one phishing, vishing or smishing incident in the past year, despite near-universal adoption of security awareness training. Compliance and risk reduction, as we have argued for years, are not the same thing, and most of the industry's tools were only ever built for the first one.

Two parts of Gartner's own analysis are worth surfacing here, both close to how we think about this shift.

The first is measurement. Gartner draws a clean line between SAT and SBM on metrics alone: training completion and click or report rates on one side, before-and-after behavior measurement on the other. Activity versus outcome. That is the exact distinction our HRM (Human Risk Management) Maturity Model draws between Level 1, where completions and click rates are the whole story, and Level 2 and above, where measured behavior change and quantified risk reduction are.

The second is who the intervention is for. In a companion piece the report itself points to, Agentic AI: The Next Frontier in Secure Behavior Management, Gartner's Candrick argues that organizations will soon need to manage risky behavior in both people and autonomous AI agents acting on their behalf, and that current approaches were not built for it. That is the direction Level 4 of our HRM Maturity Model is designed for: extending the same behavioral observation and intervention we apply to people to AI agents, on the same platform, under the same logic. It is where our roadmap is heading, not a shipped capability today.

Gartner clients can read the full report here. For our own view of where secure behavior management is heading, read The End of Security Awareness As We Know It.