Identify users with the highest human risk level
Detect vulnerable behaviors when facing simulated attacks
Measure how risk evolves over time
Evaluate the impact of awareness campaigns
Prioritize training or mitigation actions
Analyze risk at the user, group, or company level
The score is built from behavioral signals and takes the user's exposure into account to avoid bias.
Negative signals — they increase risk:
Submitting credentials
Clicks on malicious content
File downloads
Repeat offenses (the most serious event for each campaign type is considered: a click in Phishing/Smishing/QRishing, a file download in Ransomware, submitting credentials in Credential — compared across all campaign types)
Positive signals — they reduce risk:
Reporting simulations
Opening newsletters
Completed courses
Completed Learning Paths
The score is updated daily and is historical, so it reflects how behavior evolves over time.
The Human Risk Score is the platform's calculation core and is shown in several contexts:
Overview — overall company score, distribution by department and group, and evolution history
Benchmark — comparison of the score against the industry average
Employee analysis — individual score per user
Risk Detail by group or department — aggregated score with its own history per segment
No. It is calculated individually based on each user's behavior.
Yes. Positive actions such as reporting simulations or completing courses reduce risk.
They are not penalized. The model accounts for exposure to avoid bias.
Yes. The score is aggregated at different organizational levels: user, group, department, and company.
Yes. It is updated daily and dynamically, based on recent behavior.
The most serious event for the campaign type they fell for is considered (for example, a file download in Ransomware or submitting credentials in Credential, not just the click). If that event happens in more than one campaign, regardless of type, the user counts as a repeat offender.
💬 Do you have feedback about this feature or want to request improvements? Let us know at roadmap.whalemate.com/roadmap
