In March 2022, the Payment Card Industry Security Standards Council (PCI SSC) released PCI DSS v4.0, a significant update to the Payment Card Industry Data Security Standard that introduced 64 new requirements across more than 360 pages. In June 2024, the Council published PCI DSS v4.0.1, a targeted revision designed to clarify ambiguous language, address assessment-related errata, and refine applicability guidance for several existing requirements. Although no new requirements were introduced and none were removed, these clarifications have important operational implications for organizations responsible for protecting cardholder data.

By March 2025, all organizations that store, process, or transmit cardholder data were expected to achieve full compliance with PCI DSS v4.0.1. That deadline has now passed, and regulators, acquiring banks, and Qualified Security Assessors (QSAs) are actively enforcing the updated standard.

Today's attackers rarely need to bypass sophisticated security controls such as encryption or firewalls. Instead, they exploit the human element—through a convincing phone call, a carefully crafted phishing email, or a deceptive SMS message. In modern payment environments, people have become the primary attack surface.

This article explores the human-centric requirements introduced in PCI DSS v4.0.1, examines today's threat landscape, and explains how a data-driven Human Risk Intelligence (HRI) strategy enables organizations to move beyond compliance and build a stronger, more resilient security posture.

The Human Attack Surface in Cardholder Data Environments

PCI DSS defines a Cardholder Data Environment (CDE) as any system component that stores, processes, or transmits cardholder data or sensitive authentication data, together with any connected or supporting systems. In practice, this includes point-of-sale systems, e-commerce platforms, payment gateways, call center infrastructure, and a wide range of interconnected third-party services.

Every individual with access to these environments represents a potential entry point for attackers. As payment ecosystems become increasingly interconnected, protecting technology alone is no longer sufficient. Organizations must also understand and manage the risks posed by human behaviour.

How Attackers Reach Cardholder Data

The MGM Resorts cyberattack illustrates how breaches affecting payment environments have evolved into broader organizational risks rather than isolated security incidents. According to the 2026 Verizon Data Breach Investigations Report (DBIR), threat actors continue to rely on human behaviour, compromised credentials, and unpatched vulnerabilities to gain access to sensitive systems.

The report analyzed more than 31,000 security incidents, including over 22,000 confirmed data breaches worldwide. One of its most significant findings was that 62% of breaches involved the human element, underscoring the critical importance of phishing resistance, security awareness, and robust identity management.

What PCI DSS v4.0.1 Really Requires: The Human Element

PCI DSS v3.2.1 treated security awareness primarily as a compliance exercise. Organizations were expected to maintain a documented awareness program, train new employees, and provide annual refresher training. Demonstrating compliance largely meant producing evidence that training had been completed.

PCI DSS v4.0 fundamentally changed this approach, and v4.0.1 further clarified the requirements. Security awareness is no longer viewed solely as a training obligation—it is now an ongoing, role-based process focused on reducing human risk and improving security behaviors.

Requirement 12 has been significantly expanded, while several other requirements throughout the standard now explicitly address the human element of security. Together, these changes shift the emphasis from documenting training activities to demonstrating that organizations are actively identifying, managing, and reducing human-related security risks. Version 4.0 established these expectations, and v4.0.1 refined the language to eliminate ambiguity and improve consistency in assessment.

Introducing Human Risk Intelligence (HRI): From Compliance to Posture

Human Risk Intelligence (HRI) represents a significant evolution in security awareness. Rather than viewing awareness as a series of training events, HRI treats the workforce as a dynamic risk environment that can be continuously measured, analysed, and improved. It evaluates human risk across four core dimensions:

• Target Value: Target Value measures how attractive an individual is to attackers. Within a cardholder data environment, this extends beyond job title and considers factors such as seniority, organizational influence, technical privileges, access to sensitive information, online presence, contactability, security awareness, and organizational loyalty.
  
  For example, a call centre supervisor with extensive payment system access and a highly visible professional profile may present a more attractive target than a senior executive with limited access to payment systems. HRI identifies these high-value targets using the same indicators commonly leveraged by threat actors.
  
  

• Awareness: Awareness evaluates an individual's ability to recognize and respond appropriately to cyber threats. Measurements include security awareness training completion, assessment performance, phishing simulation results, and identified knowledge gaps.
  
  Importantly, awareness cannot be inferred from experience alone. An employee with many years of payment processing experience who has never encountered a realistic spear-phishing simulation may present a greater risk than a newly hired colleague who recently completed targeted security training.

• Hygiene: Hygiene assesses how technically vulnerable an individual's digital identity may be. Beyond training results, it evaluates factors such as multi-factor authentication (MFA) adoption, password strength, exposed credentials, dormant accounts, policy compliance, secondary email addresses, and email forwarding configurations.
  
  In payment environments, a single account protected by weak credentials and lacking MFA can provide attackers with a direct path into critical systems, regardless of how well trained the account owner may be.

• Access: Access measures the potential business impact should an individual's account be compromised. This includes administrative privileges, group memberships, application permissions, ownership responsibilities, and shadow administrative rights.
  
  Within a CDE, the difference between compromising a standard user account and an administrator account can determine whether a breach affects a single system or millions of payment records. Access profiling ensures that individuals with the greatest potential impact receive proportionally greater security attention.
  
  

By combining these four dimensions, organizations can generate a continuously updated Human Risk Score for every individual, reflecting changes in behavior, technical posture, and organizational context rather than relying on annual training cycles.

Understanding human risk is only the first step. To translate these insights into measurable security outcomes, organizations must embed Human Risk Intelligence into their operational security and compliance programmes.

Building a Human Risk Intelligence Program Aligned to PCI DSS v4.0.1

Implementing Human Risk Intelligence (HRI) within a Cardholder Data Environment (CDE) requires a structured, risk-based approach that aligns security capabilities with the objectives of PCI DSS v4.0.1. Rather than treating security awareness as a standalone compliance activity, organizations should integrate HRI into their broader cybersecurity strategy to continuously identify, measure, and reduce human risk.

The following diagram provides a practical roadmap for embedding Human Risk Intelligence into a PCI DSS compliance program.

• Phase 1: Establish a Baseline
  The first step is to understand where the organization currently stands. A baseline serves two purposes: it gives the security team an honest picture of organizational vulnerability, and it establishes a measurement reference point against which future progress can be demonstrated to auditors.
  ‍
  
• Phase 2: Continuous Training
  Following the baseline, training should be provided on a continuous, randomized cadence. Daily or weekly low-intensity exposure to simulated threats maintains alertness in a way that occasional high-intensity campaigns cannot. For PCI DSS v4.0.1 compliance, the simulation program should document each campaign: the template used, the population targeted, the delivery date, and the individual-level results including users who clicked, reported the simulation, or took no action.

• Phase 3: Dynamic Risk Profiling
  As user data accumulates, individual risk profiles become meaningful operational metrics. The security team can identify persistent high-risk individuals, flag departments or roles with elevated aggregate risk, and track changes in risk posture over time. Risk segmentation enables organizations to apply proportionate security controls based on measurable risk:  
  
  • High-risk individuals receive increased attention: more frequent simulations, mandatory remediation training, and potentially additional access controls (a principle emphasized by PCI DSS v4.0.1 on access management calibrated to demonstrated trustworthiness.

• Phase 4: Adaptive Intervention at the Point of Failure
  PCI DSS requires remediation to be provided to fix vulnerabilities. For example, targeted remediation training should be delivered to a user who lands on the simulated phishing page, explaining precisely what indicators they missed and what they should have done differently. From a PCI DSS compliance perspective, this approach also generates a timestamped record linking the simulation failure event to the remediation training delivery, satisfying the documentary requirements of the standard.

• Phase 5: Reporting and Continuous Evidence Generation
  ‍A HRI platform helps generate compliance evidence continuously. Qualified Security Assessor (QSA)-ready reports that document training records, remediation effort, and risk score trends should be available in the assessment cycle. This positions the organization not just for PCI DSS v4.0.1 compliance but for rapid response to security incidents: if a breach occurs, the ability to demonstrate that affected employees had received specific, recent training and been tested on relevant threat types is both a regulatory and reputational asset.

The Stakes for Payment Businesses: Why Human Risk Is a Commercial Imperative

For merchants, acquirers, issuers, payment processors, and card networks, the consequences of a cardholder data breach reach well beyond regulatory fines. Their impact extends across the business, affecting revenue, customer relationships, partner confidence, and long-term competitive position.

When a payment business suffers a breach attributable to social engineering or insider negligence, the immediate response from card brands is typically a forensic investigation mandated under the card network rules. If the investigation concludes that PCI DSS requirements were not adequately implemented, the acquiring bank may impose substantial non-compliance fines. These penalties can range from tens of thousands to hundreds of thousands of dollars per month until compliance is restored.  

Regulatory Pressure Is Intensifying Across the Payments Ecosystem

PCI DSS v4.0.1 is not the only framework tightening its requirements around human risk in payment environments. The EU's Digital Operational Resilience Act, which came into full effect in January 2025, explicitly requires financial entities to include human-factor risk in their ICT risk management frameworks, with provisions covering social engineering attacks on staff. The UK Financial Conduct Authority's operational resilience rules similarly require firms to demonstrate that their people are prepared for the threat scenarios most likely to disrupt important business services, including payment processing.

Organizations already investing in PCI DSS compliance can leverage Human Risk Intelligence to satisfy a significant proportion of these additional human-risk requirements. The behavioral measurement infrastructure, the training delivery records, and the individual risk scoring that PCI DSS v4.0.1 demands are also the evidence base that DORA, FCA rules, and similar frameworks are looking for. Compliance investment in HRI compounds across regulatory obligations rather than being confined to a single standard.

Customer Trust Is the Hardest Asset to Rebuild

For any business that processes payments, the most durable consequence of a breach is the erosion of customer trust in the payment channel itself. Research consistently shows that consumers who experience payment card fraud, or who receive notification that their card data may have been compromised, reduce their transaction frequency with the affected merchant, switch to alternative payment methods, and in significant numbers, close their accounts or cancel their cards. Years of trust built through secure, frictionless payment experiences can be undermined by a single breach notification.

Embracing a Human-Centric Future for Payment Security

PCI DSS v4.0.1 refines the framework with clearer guidance while maintaining a strong focus on the human element. By leveraging HRI, organizations can transform potential human vulnerabilities into strengths, fostering a culture of continuous security awareness and accountability.

As threats grow more sophisticated, the most effective defense combines robust technical controls with deep insights into human behaviors. As threat actors continue to evolve their tactics, organizations must evolve their approach to managing human risk.  Prioritize HRI to safeguard your cardholder data environment today. Explore the demo hub to see our security awareness solution and the wider human risk suite in action.