A human risk trajectory is the direction a person’s or group’s risk profile is moving over time. It combines behaviour patterns, access levels, and threat exposure to show whether risk is increasing or decreasing. Security teams use it to spot emerging problems before they become incidents.
Expanded Definition
A human risk trajectory is not a single score, but a time-based view of how a person’s security exposure changes as behaviours, permissions, and context shift. In identity-heavy environments, the concept helps distinguish a stable low-risk profile from one that is moving toward higher likelihood of misuse, error, or compromise. That makes it different from a static access review or a one-time insider-risk assessment.
Because usage in the industry is still evolving, the term is often applied in different ways across security, HR, and fraud teams. NHIMG treats it as an operational lens for tracking risk movement, especially where identity signals, privileged access, and unusual activity patterns intersect. That aligns well with governance thinking in the NIST Cybersecurity Framework 2.0, which emphasises ongoing risk management rather than periodic checks. The concept is also relevant when organisations monitor users, contractors, and non-human identities under the same decision model, because role changes and access drift can alter risk quickly.
The most common misapplication is treating human risk trajectory as a fixed reputation score, which occurs when organisations ignore recent behaviour changes and only rely on historical labels.
Examples and Use Cases
Implementing human risk trajectory rigorously often introduces monitoring and governance overhead, requiring organisations to weigh earlier detection against privacy, fairness, and analyst workload.
- A contractor receives broader access for a short project, then shows repeated after-hours use and unusual download patterns, suggesting the trajectory is moving upward and needs review.
- An employee’s login behaviour shifts after a phishing event, with multiple failed authentications and new device prompts indicating exposure is increasing even before a confirmed compromise.
- A privileged administrator completes mandatory training and reduces policy exceptions, showing a downward trajectory as control adherence improves.
- A service account tied to an agentic workflow starts calling sensitive APIs from new contexts, which can signal the same trajectory concept for non-human identity governance.
- Security teams correlate HR events, device health, and access logs to decide whether a user should move into enhanced monitoring or step-up verification under identity risk policy.
For identity and access decisions, this type of tracking complements the broader governance approach described in NIST CSF 2.0 and helps teams avoid reacting only after a threshold breach.
Why It Matters for Security Teams
Security teams need human risk trajectory because most real-world compromise is preceded by change, not by a single event. A user who is drifting toward higher risk may be overexposed, undertrained, socially engineered, or operating under abnormal stress long before an incident becomes obvious. Recognising that movement supports better prioritisation of alerts, access reviews, and intervention decisions.
The concept is especially useful where identity, PAM, and NHI governance overlap. A person with growing risk may warrant tighter controls, while an over-privileged bot or agent with expanding privileges may show the same pattern in machine form. That makes trajectory analysis valuable for zero-standing-privilege programs, step-up authentication, and periodic entitlement reduction. It also helps distinguish temporary anomalies from sustained deterioration, which matters when teams are deciding whether to monitor, suspend, or re-validate access.
Definitions vary across vendors and internal risk platforms, so teams should document what signals count, how quickly they are weighted, and when a trajectory triggers action. Organisations typically encounter the true operational cost only after a fraud event, insider incident, or account takeover, at which point human risk trajectory becomes unavoidable to investigate and contain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA, PR.AC | NIST CSF frames ongoing risk assessment and access control management for changing user risk. |
| NIST SP 800-63 | IAL/AAL | Identity assurance levels support evaluating whether identity evidence still matches current risk. |
| NIST SP 800-53 Rev 5 | AC-2, AU-6, IA-5 | Access review, audit analysis, and authenticator controls support trajectory-based monitoring. |
| OWASP Non-Human Identity Top 10 | NHI governance extends the same trajectory idea to service identities and automated agents. | |
| NIST Zero Trust (SP 800-207) | Continuous verification | Zero Trust relies on continuous evaluation of identity and context, matching the trajectory concept. |
Revalidate identity assurance when behaviour or context suggests the user is no longer low risk.
