What it is
The Human Risk Score distills, into a single number from 0 to 100, how much risk each employee, and the organization, represents to security. The higher, the riskier (the same direction as market indices). It turns clicks, training and quizzes into a clear priority: who needs attention first.
How the score is calculated
The score combines four dimensions, weighted heavily toward phishing:
| Dimension | Weight | What counts |
|---|---|---|
| Phishing susceptibility | 45% | Clicking raises risk; reporting mitigates; repeat offenses worsen it. Old clicks count for less (decay with a 90-day half-life) |
| Training engagement | 25% | Training assigned and not completed = latent risk |
| Knowledge | 20% | Low quiz averages = risk |
| Recency | 10% | Inactivity = blind risk (safe up to ~14 days, growing up to ~90) |
When data is missing, the weights are renormalized. If both main dimensions are missing (phishing and engagement), the score becomes indeterminate (null) rather than polluting the averages with a guess.
Bands: low (≤25), medium (≤50), high (≤75), critical (>75) and indeterminate.
flowchart LR
P[Phishing · 45%] --> SC((Human risk<br/>0 to 100))
T[Training · 25%] --> SC
K[Knowledge · 20%] --> SC
R[Recency · 10%] --> SC
classDef hl fill:#c6ff00,stroke:#c6ff00,color:#070a0e;
class SC hl
What the screen shows
In Human risk (/risk):
- Four KPIs: average score (with a trend arrow vs. the previous month, where a lower score means it improved), at risk (critical + high), assessed and indeterminate.
- Distribution by band and risk by department.
- Employee ranking with search and filter by band. Each row shows the score chip, the readable signals (“Clicked on 3 simulations”, “2 pending trainings”, “Low quiz average (58%)”, “Inactive for 40 days”) and mini-metrics. Click a person for the detail view.
- Snapshot button: records a monthly snapshot to track evolution over time (it also runs on a monthly schedule).
How to use it
- Prioritize. Sort by risk and start with the critical ones.
- Understand the why. The signals explain the score, so it’s not a black box.
- Watch the trend. The goal is for the average to fall month over month. The snapshots show whether the program is working.
To act automatically on the highest-risk people (enroll them in remediation and alert the manager), see Risk automation.
Related
- Risk automation — make the score act, not just measure.
- Executive report — the organization’s risk for leadership.
- Training campaigns — the remediation for those at risk.
