Topic starter
20/08/2026 6:07 pm
TL;DR: Click rates and training completion only show isolated behaviour, while a contextual human risk platform correlates identity, access, and threat signals to estimate who can actually create damage, according to Living Security Human Risk Management Platform. The real shift is from vanity metrics to risk governance that can distinguish low-impact mistakes from privileged-user exposure and targeted activity.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “How to Evaluate Employee Risk Scoring Platforms”.
Key questions
Q: What breaks when employee risk scoring ignores identity context?
A: It turns risk scoring into a behaviour scoreboard instead of a control signal.
Q: Why do privileged accounts change the meaning of human risk scores?
A: Privileged accounts change the score because the same unsafe action has a much larger operational blast radius.
Q: What are the signs that a human risk scoring model is failing?
A: The strongest warning signs are flat scores across very different roles, repeated reliance on click rates as the main measure, and remediation that looks identical for low-risk and privileged users.
Practitioner guidance
- Implement identity-aware risk weighting Weight behavioural events by account privilege, business function, and reachable systems so a single click is not treated the same across the workforce.
- Fuse IAM and threat feeds into scoring Connect identity provider, access, endpoint, and threat-intelligence data into one scoring pipeline so high-risk patterns are evaluated in context.
- Separate hygiene metrics from exposure metrics Keep training completion and phishing click rates as programme health indicators, but report a separate score that reflects actual operational exposure.
Bottom line: Behaviour-only human risk scoring is too narrow to support serious governance because it cannot account for access scope or adversary targeting.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:41 pm
Identity context is the difference between training metrics and real risk governance. Click rates and completion percentages are useful only as hygiene indicators. Once identity data is added, the organisation can distinguish whether the risky behaviour sits on an ordinary user, a privileged administrator, or a highly connected account. That shift turns human risk scoring into an access-governance control, not a compliance scorecard.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do security teams know if identity risk scoring is working?
A: Identity risk scoring is working when the programme can explain why scores changed, when score movement predicts incidents before they become obvious, and when remediation measurably lowers exposure. If the score cannot be defended, tracked, or tied to action, it is only a dashboard number.
👉 Read our full editorial: Employee risk scoring is really an identity risk problem