Human Risk Scoring

Overview

A human risk score turns training-completion and phishing-simulation signal into one comparable number per user (and rolled up per org), so an MSP can prioritize remedial attention the same way tenant-exposure-ranker in secops-pack prioritizes technical exposure. The design goal here is the same discipline that pack applies: an explainable ranked comparison with visible inputs, never an opaque score a reviewer has to take on faith.

Anti-triggers

• A vendor's own user risk score — KnowBe4 and Proofpoint each compute one from their own data alone; use knowbe4-reporting or proofpoint-people. This skill blends inputs across tools and keeps the factor table visible.
• Technical exposure ranking — ranking tenants or endpoints by threat and configuration posture is a different axis from human risk; use alert-severity-normalization in secops-pack.

Step Zero: Confirm What's Connected

Call conduit__search_tools to determine which inputs are actually available before scoring anything. This skill's inputs, from strongest to weakest available data:

1. Training completion (from training-completion-tracking) — whether the user is current on required training, and how overdue they are if not.
2. Phishing-simulation performance (from phishing-simulation-analysis) — click/fail history and repeat-clicker status.
3. Real-world click-through data (optional) — from a connected email-security tool (Proofpoint, Avanan) exposing actual click or attack-targeting signal, where available.

Not every input will be available for every client. Score with whatever subset is connected, and always state explicitly which inputs were used for a given score — a score computed from training data alone is a different, less complete signal than one that also incorporates simulation and real-click data, and the output must make that difference visible rather than presenting both as equally authoritative.

Key Concepts

A simple, explainable scoring approach

Avoid building an opaque composite score. Instead, use a small number of weighted factors, each independently visible in the output:

Factor	Signal	Relative weight
Training overdue	Overdue assignment(s), and how overdue (days past due)	Highest — an overdue user is a known, current gap
Repeat phishing-sim failures	2+ simulated-phishing failures, weighted higher for more recent and more frequent failures	High
Single/no phishing-sim failure	0–1 failures in available history	Neutral to low, depending on completeness of history
Real-world click/attack-targeting signal (optional)	A real click, credential-harvest event, or "attacked person" designation from a connected email-security tool	Compounding — when present alongside repeat sim failures, this pushes the user into the highest risk tier rather than just adding linearly

Do not fabricate a precise numeric weight scheme (e.g. "37% + 28% + ...") unless the operator has asked for one and supplied real weights — a three-tier bucket (Low / Elevated / High risk) driven by the factor table above is more honest about the precision this data actually supports than a false-precision single percentage. If a numeric score is wanted, keep the formula visible in the output rather than presenting a bare number.

Per-user vs. per-org rollup

Score individual users first — this is where the actionable remediation lives (assign this specific person to retraining, flag this specific account for closer monitoring). Roll up to an org-level score as a distribution summary (e.g. "12% of users High risk, 30% Elevated, 58% Low") rather than a single blended org score that hides which specific users drive it. A per-org score is useful for portfolio-level prioritization, but it should always be paired with the underlying distribution and the list of highest-risk individuals, not presented alone.

Graceful degradation when phishing-simulation data isn't available

If no phishing-simulation platform is connected for a client, do not block scoring — degrade to training-completion-only scoring:

1. Score users purely on training-overdue status and severity (days overdue, number of overdue modules).
2. Label the output explicitly as "training-completion-only score — no phishing-simulation data connected" so it is never mistaken for the fuller score.
3. If a phishing-simulation platform is later connected, re-run to get the fuller score rather than blending partial-era data with full-era data silently.

The same degradation logic applies if training data isn't available but simulation data is — score on simulation performance alone and label accordingly. A score with zero connected inputs cannot be produced; say so explicitly rather than returning an empty or fabricated ranking.

Common Workflows

Per-user risk scoring for a client

1. Discover connected inputs via conduit__search_tools.
2. Pull training-completion status via training-completion-tracking.
3. Pull phishing-simulation history via phishing-simulation-analysis, if connected.
4. Pull real-click/attack-targeting signal from a connected email-security tool, if available, as compounding-risk enrichment.
5. Apply the factor table to bucket each user into Low / Elevated / High risk, with the specific triggering factors shown per user.
6. Rank users within the client by risk tier, highest first.

Portfolio-wide human risk ranking

1. Run the per-user workflow above for every client in scope.
2. Roll up to a per-org risk distribution and an overall org risk tier.
3. Rank orgs by proportion of High-risk users (not raw count, so a large org isn't penalized purely for having more users) and surface the specific highest-risk individuals per org for remediation follow-up.
4. Present orgs with zero connected training/awareness tooling as unmeasured, separate from the ranked list — a silent 0-risk score for an unmeasured org is a data gap, not a clean bill of health.

Error Handling

No training or simulation data connected at all

State plainly that no human-risk scoring is possible for this client — do not produce a fabricated Low-risk score by default.

Only training data available

Produce a training-completion-only score, explicitly labeled as such.

Only simulation data available

Produce a simulation-only score, explicitly labeled as such, and note that training-overdue status wasn't available as an input.

Real-click enrichment unavailable

Proceed with training + simulation scoring; note that real-world click-through enrichment wasn't available rather than treating its absence as a scoring failure.

Related Skills

• Training Completion Tracking — the primary input for training-overdue severity.
• Phishing Simulation Analysis — the primary input for click-rate and repeat-clicker severity.