Every signal about human risk, in one score
A baseline assessment, phishing and drill results, lessons in Slack and Teams, warnings in the browser and alerts from your identity tools all feed one explainable score per person. The score then decides who gets which training.
The score, the baseline assessment and risk automation are included in every plan.
- Baseline assessment Two-minute check-ins in Slack, Teams or email Gap: payment fraud
- Phishing and smishing Email and SMS simulations Submitted credentials
- Drills Deepfake, voice, chat, QR and more Deepfake call: failed
- Training Courses, remediation and chat lessons 2 lessons overdue
Human Risk Score
- Phishing susceptibility 78
- Remediation debt 60
- Training hygiene 42
- External signals 55
- Security knowledge 50
Example person. Point at a source to see what it feeds.
- Slack Report to Security and message checks Reported a message
- Microsoft Teams Lessons, check-ins, reports and checks Checked a link: suspicious
- Browser extension Look-alike sites, risky consent, AI pastes Continued past a look-alike
- Identity and security tools Entra ID, Defender, Chrome, your SIEM Risky sign-in, high
Where the signals come from
Each source measures something different. Together they show who is likely to slip, who reports, and what each person still needs to learn.
Know every gap before the first campaign
Security Check-ins measure what each person knows across eight topics, from phishing and payment fraud to AI tools and incident reporting. Short, adaptive questions arrive once a week where people already work.
Feeds: Security knowledge
- Two minutes, once a week
- At most five questions per check-in over about four weeks, then a monthly re-check. People answer in a Slack DM, a Teams card or a one-click email, with an honest "I’m not sure" option.
- Gaps, not guesses
- One wrong answer never makes a gap; it takes repeated misses. Topics nobody was asked about are never treated as gaps, and groups under three people show "not enough data".
- Training that matches the gap
- Risk automation can enroll each person in the path for each topic they missed, and the gaps feed a Security knowledge sub-score in the Human Risk Score.
Training that arrives where people already work
Two-minute lessons and 30-second spot-it quizzes land as direct messages in Slack and Microsoft Teams, and people finish them right in the chat. Every completed lesson counts toward the score.
Feeds: Training hygiene
Browse the training catalogue- Programs on your schedule
- Pick lessons as a track, a rotation or a list, aim them at teams, groups, roles or new hires, and send them in each person’s local time. Daily and weekly caps keep anyone from being flooded. People outside Slack and Teams can get the same lessons by email and take them in the browser.
- Lessons right when they matter
- Just-in-time lessons can follow a clicked or reported simulation, a new hire’s first days, a role change or a seasonal scam, at most one a day.
- Respectful by default
- People can snooze a program or mute optional lessons from the Slack Home tab or the Teams Training tab. Programs you mark required still arrive.
- A monthly security digest
- Post a summary of reports, checks, threat waves and lesson completion to a Slack or Teams channel, with Nice catch shout-outs for people who opt in.
Turn every suspicious message into a signal
Anyone can report a suspicious Slack or Teams message to your security team in two clicks, or ask RansomLeak to check it first. Reporting counts in the person’s favor, so the score rewards the habit you want.
Feeds: External signals
- Report to Security
- A message shortcut or a fishing-pole reaction in Slack, a message action in Teams. Reports reach your security channel or mailbox with a link to the original message, and the reporter gets an instant thank-you.
- Check before you click
- Check with RansomLeak answers privately with Looks dangerous, Suspicious or No known red flags, and the reasons. Rules decide the verdict: known bad sites, new and look-alike domains, pressure and payment requests. No AI, and nothing is opened.
- Built so it can’t be gamed
- Reporting the same message twice doesn’t count twice, and at most one report per person counts every 30 days. Checked text is kept for 30 minutes, then deleted; only the domain is stored.
Real behavior under a real lure
Phishing and smishing simulations show what people actually do with a convincing message. Drills go further, from a deepfake call from the "CFO" to an "IT support" chat asking for an MFA code.
Feeds: Phishing susceptibility
Explore phishing simulations- Every outcome, weighed
- Opened, clicked, submitted data, opened an attachment, granted an app access or replied to a fraud request. Scanners and auto-replies are filtered out, so bots never inflate a score.
- Drills feed the same score
- Failed drills count toward training hygiene alongside overdue lessons and weak quiz results, across voice, deepfake, chat, QR code, MFA fatigue and OAuth scenarios.
- Remediation on the spot
- A failed simulation can enroll the person in a follow-up lesson straight away, and repeat failures can escalate to their manager. People who report are never enrolled.
The browser becomes a sensor
The free RansomLeak extension for Chrome and Edge warns people on look-alike sites, newly registered domains, risky app consent screens and sensitive pastes into AI tools, and offers a 60-second lesson right on the warning. What they do next becomes a signal.
Feeds: External signals
How the browser extension works- Decisions, not browsing
- The score counts going past a warning, credits going back, and credits a confirmed site report at most once every 30 days. Domain checks run on the device.
- Never the private parts
- Only the host name and time of a warned site, and which short lesson someone finished, reach RansomLeak. Never passwords, form values, page content, pasted text or browsing history, and employees can see exactly what is known about them.
- Free and open to inspection
- The extension is free for every workspace and its source code is public, so your security team can read what it does before rollout.
- Teaching at the risky moment
- After a risky moment, a short lesson chosen for that situation appears on the person’s tab as Recommended for you. Lessons are recorded and never change the score.
Bring the signals your stack already has
Connect Microsoft Entra ID, Defender and Google Chrome Enterprise, or push anything else from your SIEM with an API call or a CSV. Each signal shows up in the person’s score breakdown with its source.
Feeds: External signals
- Pulled hourly
- Risky sign-ins and leaked credentials from Entra ID, app consent grants, password reuse and risky extensions from Defender and Chrome reports. Each integration lists the license it needs.
- Pushed from anywhere
- Send up to 1,000 signals per call, such as true-positive SOC alerts, privileges or account flags, or a custom signal type you define. A dry run shows what would land before anything does.
- You stay in control
- Switch any signal off or change how much it counts. Send nothing at all and the score works from the other sources alone.
One score that shows its work
A number nobody can explain is a number nobody acts on. Every score opens to the evidence behind it.
- 0 to 100, in four bands
- Higher means riskier. Everyone lands in Low, Moderate, High or Critical, so you act on a band without arguing over single points.
- Five sub-scores you can weigh
- Phishing susceptibility, remediation debt, training hygiene, external signals and security knowledge. Only sources with data for a person count, so a missing source never drags anyone to a false middle.
- Recent behavior counts most
- An event’s weight halves every 90 days, so people who improve watch their score fall. Scores recalculate every night.
- Why this score
- Open any person to see each sub-score, its weight, the reported signals and the assessment gaps behind it. Roll it up to teams and the whole organization, with the trend over time.
Act on the score automatically
A risk number is only useful if something happens next. No-code rules turn the score into the right intervention, with guardrails a CISO can sign off on.
What a rule can do
- Enroll in the right path
- When someone reaches a band or score, or shows an assessment gap, enroll them in a learning path with a deadline and a grace period.
- Tell the manager
- A daily digest tells each manager which direct reports have stayed at elevated risk, so the conversation happens close to the person.
- Follow the score, not a list
- Rules run every night after scoring, so people flow into action as risk rises and out of it as they improve.
Guardrails that hold
- Dry run first
- See who a rule would match and what it would do before anything is sent or created.
- Blast-radius cap
- A run that would act on more than 10% of people is skipped whole, so one bad rule can’t reach the company.
- Cooldowns and confidence
- Per-person cooldowns stop repeat nudges, and a minimum confidence waits for enough data.
- Every action logged
- An action log records every enrollment and alert, applied or simulated, for your auditors.
Watch risk fall, one person at a time
Each source moves the score a little, and the score decides what happens next. Here is what Jordan’s next month can look like.
72Jordan Lee, day 1, High
31Day 30, Moderate
- Day 1 · Slack First check-in finds a payment fraud gap
- Day 4 · Automation Enrolled in the payment fraud path
- Day 11 · Simulation Clicked a lure; a lesson followed at once
- Day 18 · Browser Went back on a look-alike sign-in page
- Day 24 · Teams Reported a real phishing message
Evidence your auditor can use
Completed training proves people were taught. The Compliance page also shows that learning continued and that behavior changed, each with its own CSV.
See framework coverage- Annual training Completion by framework and learning path, rosters for SOC 2, ISO 27001, NIS2, PCI DSS and more, and an attestation PDF per person that also lists their chat lessons.
- Program effectiveness Phishing report and click rates by quarter and by team, and the average Human Risk Score month by month. Aggregates only, small groups withheld.
- Ongoing awareness Twelve months of chat lessons, kept apart as supplementary evidence so they never inflate annual completion.
- Browser protection Extension coverage, enrolled devices, the detector policy in force, outdated browsers and lessons completed after a warning.
Private by design
A score people trust has to respect them. These limits are built in, not configured after the fact.
- No dark web, no OSINT
- Scores come only from behavior inside your program and signals you choose to send. Nothing is scraped or bought about your people.
- Individual scores are gated
- Seeing a person’s score needs its own permission. Managers see their direct reports, everyone else sees aggregates.
- Small groups stay anonymous
- Assessment results under three people show "not enough data", and digest teams under five are folded together.
- Message content stays out
- Checked text is deleted after 30 minutes, the browser sends host names only, and the digest never shows message text or individual scores.
Send risk where you already look
Human risk shouldn’t need another tab.
- Datadog Hourly Human Risk Score per team, plus a ready dashboard.
- New Relic Per-team risk metrics with a quickstart dashboard and alerts.
- Webhooks Signed events for failed simulations, reports and new assessment gaps.
- API Push signals in, or route people into groups and paths by an external score.
Human risk management vs security awareness training
Training is one input. Human risk management is the program that decides who gets it, and proves it worked.
Human risk management
- Scores every person 0 to 100 from real behavior and every source you connect
- Starts with a baseline of what each person knows
- Targets the small group that carries most of the exposure
- Triggers training automatically when someone crosses a threshold
- Re-tests the same person and shows whether risk fell
Security awareness training on its own
- Assigns the same modules to everyone on a fixed calendar
- Measures completion, which says nothing about susceptibility
- Treats a repeat clicker and a consistent reporter identically
- Ends when the course ends, with no re-test
- Produces a compliance record rather than a risk signal
See every signal in one score
We will walk you through the sources, the score and the automation, and how they fit the tools you already run.
The score, the baseline assessment and risk automation are included in every plan.
Frequently asked questions
What is human risk management?
Human risk management is a security program that measures how likely each employee is to fall for an attack, then reduces that risk with targeted training and automation. It treats human risk as a number you track per person, not a box you tick once a year.
A small group of repeat clickers carries most of the exposure, and the Verizon 2024 Data Breach Investigations Report found a human element in 68% of breaches.
RansomLeak runs it as one loop. A baseline assessment finds knowledge gaps, simulations, drills, chat apps, the browser and your identity tools add real behavior, a human risk score brings it together per person, and risk-based automation assigns the training that brings the score down.
How is human risk management different from security awareness training?
Security awareness training is the content that teaches employees to spot attacks. Human risk management is the program around it: it measures who is at risk, decides who needs which training, and shows whether risk actually fell.
Training is one input. HRM adds measurement through the score, real behavior through simulations, drills and chat apps, and action through automation.
What is a human risk score?
A human risk score is a number, here on a 0 to 100 scale, that estimates how likely a specific employee is to fall for a social-engineering attack. Higher means riskier.
RansomLeak builds it from five sub-scores: phishing susceptibility, remediation debt, training hygiene, external signals and security knowledge. Everyone lands in a Low, Moderate, High or Critical band.
How does the baseline assessment work?
Security Check-ins send a few short questions once a week in Slack, Teams or a one-click email, about two minutes each, over roughly four weeks, then a monthly re-check. They cover eight topics, from phishing and payment fraud to AI tools and incident reporting.
A gap needs repeated misses, never one wrong answer, and topics nobody was asked about are never counted as gaps. Gaps can trigger matching training automatically and feed the security knowledge sub-score.
How often does the score update?
Scores recalculate every night. Signals pushed through the API trigger a recompute of the affected people within minutes.
Every event fades on a 90-day half-life, so recent behavior dominates and people who improve see their score fall.
Do you use dark web or OSINT data to score people?
No. We do not pull breach databases, social-media footprints or any other external profiling, and we never buy data about your people.
The score uses behavior inside your own program plus signals you choose to send from your own tools. Every point traces back to something a person did or a signal your stack raised, which matters for works-council and privacy review.
What does the browser extension collect?
Only the host name and time of sites that triggered a warning or that someone reported, what they chose on the warning, the app name and permissions on risky consent screens, and, if you turn it on, the category of a sensitive paste into an AI tool. When someone finishes a short lesson, only its type is recorded. Never the pasted text.
It never reads passwords, form values, page content or browsing history, and employees can see what is known about them.
What triggers an automation?
A rule fires when a person reaches a risk band, a score threshold or an assessment topic gap. You can add a minimum confidence so it waits for enough data, and require the risk to persist for a number of days.
Rules run every night after scoring. Actions are enrolling in a learning path with a deadline, or alerting the manager through a daily digest.
Can I test a rule before it affects anyone?
Yes. Every rule can run as a dry run, which shows who it would match and what it would do while sending nothing and creating no enrollments.
A run that would act on more than 10% of people is skipped whole, and every action is logged.
Does it change phishing difficulty for risky users?
Not today. Automation focuses on training enrollment, remediation and manager alerts. Adapting simulation difficulty per person is not a current claim.
Can I use the Human Risk Score as compliance evidence?
As effectiveness evidence, yes. Annual training evidence still comes from completed learning paths mapped to frameworks such as SOC 2, ISO 27001, NIS2 and PCI DSS.
On top of that, the Compliance page shows phishing report and click rates by quarter and the average risk score over time, so you can show the program changes behavior. These figures are aggregates: no individual score appears in any export. Chat lessons appear separately as supplementary ongoing awareness.
Can I see human risk in my own tools?
Yes. RansomLeak sends hourly per-team Human Risk Score metrics to Datadog and New Relic, with ready dashboards, and signed webhooks for failed simulations, reports and assessment gaps.