Human risk score
An indicator that summarizes the security risk of a person or team based on observed behavior: simulations, exposed credentials, retests.
Full definition
A human risk score is an indicator that summarizes the security risk level of a person, a team or an organization based on observed behavior: simulation results, credentials exposed in breaches, response to training and retest performance.
Its value depends on the quality of the input. A score built on completed courses and self-assessments measures administrative diligence; one built on real behavior under pressure measures risk. Sample size also matters: with very small teams the individual score loses statistical validity and is better read by group.
Used well, the score prioritizes: it directs the most demanding simulations and training toward those who need them most, and gives leadership a risk curve that can be tracked over time, compared across areas and presented in an executive report.
Related terms
Human risk management (HRM)
The discipline that measures and reduces the security risk originating in people's behavior, using continuous data instead of annual courses.
Retest
A new simulation of the same attack category, weeks after a failure and with a different template, to verify the person actually changed their behavior.
Click rate
The percentage of people who click a phishing simulation. Useful as a signal, misleading as the only metric of a program.
Leaked credentials
Usernames and passwords exposed in breaches or stolen by malware, circulating on the dark web. They are the raw material of initial access to companies.
From definition to data: measure your company's human risk
Fensivo detects leaked credentials, simulates real attacks and validates with retests that behavior changed.