What Is a Human Risk Score?
A human risk score is a measurable indicator of how likely an individual, team, or organization is to be involved in a security incident based on observed behavior, rather than assumptions or guesswork. It typically draws on data such as phishing simulation results, reporting habits, training completion, and access privileges to produce a clearer picture of where risk actually sits.
Unlike a simple training completion rate, a human risk score reflects real behavior over time. Someone who completes every training module but consistently clicks on phishing simulations presents a very different risk profile than someone who reports suspicious activity quickly and rarely makes mistakes, even if their completion records look identical on paper.
Human risk scores are useful at multiple levels. At the individual level, they help identify who may benefit from more targeted support. At the team or department level, they reveal patterns, such as a particular group being repeatedly targeted by convincing phishing attempts, or consistently underperforming on reporting speed. At the organizational level, they give leadership a measurable way to track progress over time.
A well-designed human risk score should be used to guide support, not to assign blame. The goal is to direct training and resources where they are genuinely needed, helping the people who need it most while giving security and compliance teams credible evidence of how risk is changing across the organization.