What it is
Risk-based automation lets the Human Risk Score take action on its own: the platform starts automatically enrolling employees above a chosen risk band into a remediation campaign, and notifying the manager on a regular basis. It is opt-in per tenant and ships turned off by default.
You configure it in a collapsible card at the top of the Human Risk screen (/risk), visible to the TENANT_ADMIN.
What it does
When active, a daily routine:
- Auto-enrolls into remediation. Every employee in the chosen minimum band (or above) is enrolled in the training campaign you defined as remediation. It is idempotent: no duplicates, and if the person has already completed it, the training reopens as a refresher.
- Sends a digest to the manager, a summary with the color-coded bands and a shortcut to act, sent to the
TENANT_ADMIN(and to any extra emails you list). The alert is capped at 1×/week so it doesn’t become noise.
flowchart LR
RS[Human Risk] --> B{Above the<br/>minimum band?}
B -->|Yes| E[Auto-enroll into remediation]
B -->|Yes| N[Weekly digest to manager]
E --> RS
classDef hl fill:#c6ff00,stroke:#c6ff00,color:#070a0e;
class E hl
Configure
In the automation card, under Human Risk:
| Field | What it does |
|---|---|
| Enable | Turns the automation on/off (default: off) |
| Minimum band | Which band to act from: high or critical |
| Remediation campaign | The training campaign where at-risk people are enrolled |
| Notify the manager | Turns on the weekly digest |
| Additional emails | Extra recipients of the alert |
There is also a run now action (bypasses the weekly cap), handy for testing the configuration.
Choose a remediation campaign that is already published and makes sense as a refresher. Auto-enrollment respects the same delivery rules as training campaigns.
Auditing
Everything is recorded in the audit log, under risk.auto_enroll and risk.alert, with the actor marked as system/automation. You get full traceability of who was enrolled and when the alert went out.
Related
- Human Risk Score — the index that triggers the automation.
- Training campaigns — the remediation.
