How the Human Risk Score is calculated
Seven weighted components on a 0–100 scale, identical on every surface. Six add to the score. One — reporting a suspicious message — is the only component that subtracts, so the people who raise their hand lower their own number. Every component is weighted by a published, auditable method.
| Phishing behaviour | Clicks, credential entry and callback engagement across all eight simulated channels. | 30% |
|---|---|---|
| Training discipline | Assignment completion, time on content, and the skipped / fast-clicker rate. | 25% |
| Endpoint | Malware and control-failure signals from the endpoint tooling you already run. | 15% |
| Identity hygiene | MFA posture, password practice and directory-visible account hygiene, from directory sync. | 10% |
| Data protection | DLP and data-handling signals from your existing security stack. | 10% |
| Dark web exposure | Credentials and employee data surfacing in breach dumps. | 10% |
| Reporter contribution | The only component that runs the other way. Report an attack and your own score falls. | −10% |
Breach and dark-web exposure is deliberately kept out of personal blame — someone whose address appeared in a 2017 dump did not choose to be there. Which systems feed which signals is listed on the integrations page.
Multi-dimensional risk sources, one objective number
NOUSEC is fed by real employee behavior and integrated security signals — not questionnaires or estimates. The result is a risk map built on measurable, objective, continuously updated data.
The scoring method itself — which signals to use, how to weight them, and how to report the result to a board — is set out in our guide to calculating a human risk score.
Built to survive board scrutiny
A metric only works if leadership trusts it. The Human Risk Score is designed for the three questions every board asks.
Frequently asked questions
What is a Human Risk Score?
A Human Risk Score is a single, board-readable number that quantifies how vulnerable an organization's people are to social engineering. NOUSEC combines seven weighted components — simulation results across eight channels, training discipline, endpoint and threat signals, identity hygiene, data-protection signals, dark-web exposure and reporter contribution — into one score per employee, per department, and per company.
How is the score calculated?
The methodology is published openly. Seven weighted components produce a 0–100 score: phishing behaviour 30%, training discipline 25%, endpoint 15%, identity hygiene 10%, data protection 10%, dark web exposure 10%, minus reporter contribution 10%. Reporting is the only component that subtracts, so employees who report suspicious messages lower their own score. Bands are Champion 0–25, Learner 26–50, At-Risk 51–74 and Critical 75–100. No black box — bring your security team's hardest questions.
What feeds each component?
Phishing behaviour and reporter contribution come from simulation and reporting data; training discipline from the training platform; identity hygiene from directory sync; endpoint, data protection and dark web exposure from the security tooling and breach-monitoring sources you connect. The integrations page lists which systems connect.
Can we compare our score against other companies?
Yes. Scoring is benchmarked against industry baselines such as the Verizon DBIR, so leadership sees not just an internal trend but where the organization stands against its sector.
How often does the score update?
Continuously. Every simulation result, completed training and reported message updates the score — so it behaves like the security metrics your team already trends, not an annual audit artifact.
See a live Human Risk Score built from your industry's benchmark data — in a 20-minute demo.
Book a demo