Human Risk Scoring

Human Risk Scoring

Overview

A human risk score turns training-completion and phishing-simulation signal into one comparable number per user (and rolled up per org), so an MSP can prioritize remedial attention the same way tenant-exposure-ranker in secops-pack prioritizes technical exposure. The design goal here is the same discipline that pack applies: an explainable ranked comparison with visible inputs, never an opaque score a reviewer has to take on faith.

Anti-triggers

• A vendor's own user risk score — KnowBe4 and Proofpoint each compute one from their own data alone; use knowbe4-reporting or proofpoint-people. This skill blends inputs across tools and keeps the factor table visible.
• Technical exposure ranking — ranking tenants or endpoints by threat and configuration posture is a different axis from human risk; use alert-severity-normalization in secops-pack.

Step Zero: Confirm What's Connected

Call conduit__search_tools to determine which inputs are actually available before scoring anything. This skill's inputs, from strongest to weakest available data:

1. Training completion (from training-completion-tracking) — whether the user is current on required training, and how overdue they are if not.
2. Phishing-simulation performance (from phishing-simulation-analysis) — click/fail history and repeat-clicker status.
3. Real-world click-through data (optional) — from a connected email-security tool (Proofpoint, Avanan) exposing actual click or attack-targeting signal, where available.

Not every input will be available for every client. Score with whatever subset is connected, and always state explicitly which inputs were used for a given score — a score computed from training data alone is a different, less complete signal than one that also incorporates simulation and real-click data, and the output must make that difference visible rather than presenting both as equally authoritative.