Human Risk Analytics
Measure employee cyber risk and improvement
Use human risk insights to understand where employees need support and how their responses change over time. PhishSheriff helps security teams turn programme activity into clearer priorities for action.
34/ 100
Avg Human Risk Score
4.2hrs
Avg time to report
12.8%
High-risk people
The Human Risk Score
Understand what the Human Risk Score tells you
A Human Risk Score helps organise available risk signals into a practical view for security teams. Interpret it alongside the underlying events, context and programme results.
More than a click rate
Click rate is one useful measure. The score also considers other available signals, such as reporting and what happened after a click.
Read it with context
Look at the events behind a score before acting on it. The score helps prioritise follow-up; it is not a prediction that a person will be breached.
What goes into the score
Signals the score can use
Simulation and reporting activity are the starting point. The signals available depend on your deployment.
What they do in a simulation
Not just the click: did they submit the form, open the attachment or report the message?
Learning activity
Whether assigned awareness training was completed, and how people did in it.
How fast they report
The time between receiving a suspicious email and reporting it to security.
How the score works
Three ideas behind the score
Risky actions add up
Every risky behaviour adds points. The more often it happens, the more it counts.
Severity is weighted
Entering a password is weighted far heavier than simply opening an email.
Standing out costs more
If someone is far riskier than their team, their score climbs faster.
Risk over time
Follow how risk changes over time
Track the organisation’s average score across the year and compare it with the activity behind it, such as which scenarios ran and how many people took part.
Average Human Risk Score
Demo dataWho needs attention
The people to support first
A ranked list of the people and teams with the highest scores. Open any row to see the activity behind it. Names and figures below are examples.
Submitted credentials in 3 of the last 4 simulations and did not report any of them.
By team
See how teams compare
Spot which teams carry the most risk, then focus follow-up there first.
Average risk by team
company avg 58Compare each team against the company average to see where risk is concentrated.
Illustrative example with demonstration data, not customer results.
Easy to run
From insight to follow-up
Click to see the full story
Open any person to see what happened and when their score changed.
Assign follow-up training
Assign targeted training to a person or team straight from the list.
See how PhishSheriff fits your security programme
Explore the platform with a walkthrough focused on your organisation's priorities, users and email environment.
FAQ
Frequently asked questions
- What does a Human Risk Score mean?
- A Human Risk Score summarises selected risk signals to help security teams prioritise follow-up. It should be interpreted with the underlying activity, scoring method and organisational context, rather than treated as a guarantee about an individual's future behaviour.
- Is a lower click rate enough to show improvement?
- Click rate is one useful measure, but it does not describe the entire programme. Reporting behaviour, response timing, scenario difficulty, participation and other available measures can help explain the result more accurately.