The Human Risk page

A client’s CISO emails you: “Who at our company is the biggest security risk right now?” The Human Risk page is where you answer that — aggregate scores across every user at the client, ranked, with the four signals that drove each score visible at a glance.

It’s also where you go when planning reinforcement training, prepping for a QBR, or just doing routine health checks on a client between scheduled reports.

Where this lives

Open the client → Risk. The page header reads “Human Risk — Aggregate risk assessment across all signals.”

This page is a point in time. To show how those scores moved, click Risk Progress report in the page header: we email you a PDF covering the last 12 months — the client’s average score as a trend line, then a card for each person whose score moved. The cards are grouped: people who improved through what they did come first, then people whose score rose only because old events aged out, then people with no change, then people whose score declined. Each change is split into what the person earned through training and phishing results and what simply aged out of the scoring window, so a rising score is only called improvement when it is one.

Human Risk page — four KPI cards across the top, Users at Risk table below with filter chips.

The four KPI cards

Top of the page. Each one is a button — click it and you drop onto the relevant tab pre-filtered to that slice.

Overall Risk Score — a letter grade (A through F) representing the average score across every user at this client, with the user count.
High Risk Users — count of users currently in the “high risk” bucket. Goes red when above zero.
Phishing Fail Rate — share of phishing tests sent in the rolling 90 days that the user failed: clicked the link, submitted credentials, or opened the attachment. Reporting a test is never a failure. Green when ≤5%, warning above. Counts current users only by default; tick Include inactive and offboarded users on the Phishing tab to keep results from people who have since left, which is what the Phishing Activity list shows.
Dark Web Exposures — count of users with at least one breach hit. Only appears when Dark Web Monitoring is enabled for the client and as your partner add-on. Subtitle shows how many exposed passwords are still unresolved.

The tabs

Six tabs sit below the KPI cards (five when Dark Web Monitoring is off). Every table on them sorts by any column — click the column header.

Users at Risk

Per-user table — name, role, risk score (letter + number), phishing clicks in the last twelve months, phishing reports in the last twelve months, dark web records (if DWM is on).

Filter chips at the top: All Users, High Risk, Medium Risk, Low Risk. The thresholds are visible by clicking each chip and watching the table contract — the boundaries reflect what the table itself uses to bucket users. Clicking the “High Risk Users” KPI card jumps you here pre-filtered.

Click any row to open that user’s full risk profile (see Per-user drilldown below).

Risk Over Time

The client’s average risk score as a trend line over the last 3 months, 6 months, or 12 months, with the average score, the change over the period, the high-risk user count then and now, and Where the grades moved — how many people held each grade at the start versus now. It’s the on-screen version of the trend in the Risk Progress report.

Training Performance

Four mini-cards at the top — Total Users, On Track %, Action Required (overdue user count), Avg Completion % — then a per-user table with department, status (Up to Date / Due Soon / Overdue), completed-of-assigned course counts, completion percentage with a progress bar, next due date, and on-time completion rate. Filter chips — Overdue, Due Soon, Up to Date — narrow the table; the Users Overdue on Training quick action on the client’s Health page lands here with Overdue selected.

This tab matches what the Training Performance PDF report covers — same data, browsable in the dashboard.

Phishing Results

Three cards: Overall Fail Rate, Weakest Category (the category of phishing test with the highest fail rate), Report Rate (how many users are flagging tests).

Below: Results by Category — every phishing template type sent to this client over the rolling 90 days, with sent / failed / fail-rate / reported / report-rate per row, and color-coded fail-rate bars. When the tests sent carry a defensive-behavior tag, a Results by Defensive Behavior table shows the same numbers by skill (for example, Verify the sender).

If any user failed a test in the last twelve months — clicked the link, submitted credentials, or opened the attachment — a Users Who Failed a Simulation table appears below, most failures first, with their current risk score next to each row.

Dark Web Monitoring (when DWM is on)

Three cards: Exposed Users, Total Dark Web Records, Critical Users (anyone with a password breach or high-severity exposure).

Below: per-user breach table with total records, unresolved passwords, highest risk (Critical / Medium / Low), and whether passwords were exposed. Click into any user to see the breach detail and resolve actions.

Reported Phishing

Two cards: Reported (90 days) count, Report Rate.

Below: list of every simulation a user has flagged in the last 90 days — name, subject, date. Rows on this tab don’t open a profile.

This is the “your users are paying attention” tab. A healthy report rate (≥20%) means your training is landing.

Per-user drilldown

Click any user row on the Users at Risk, Training Performance, Phishing Results, or Dark Web Monitoring tab and you land on their personal risk profile.

What you can see:

Their risk grade at the top, alongside the raw score, plus course completions, phishing clicks / reports, and dark web exposures for the last 12 months.
Risk Progress — how this person’s score moved over the last 3, 6, or 12 months.
Score Breakdown — the starting score for their role, then each signal that added or took away points, down to the final score.
Their role — Admin / Executive / HR / Finance / Standard, shown on the Score Breakdown. The role affects how the score interprets the user’s activity; to change it, click Override, pick a role, and click Save (Reset removes your override).
Their training curriculum — every course assigned, due dates, completion status, and the tier badge (Required / Core / Recommended / Elective).
Their phishing history — every test they were sent in the last 12 months, with the status of each: Sent, Opened, Clicked, Reported, Credentials Submitted, Attachment Opened. Color-coded so the bad outcomes stand out.
Their breach detail (when DWM is on) — every breach the user’s email appears in, with tier badges (Password / PII / Info) and a Mark Resolved button on each unresolved password breach. Password breaches more than a year old are resolved automatically and labeled Auto-resolved, so you can tell them apart from ones a person resolved.

What you can do:

Send a training reminder — Send Reminder sends a one-off “you have training due” email to this specific user. Standalone from the automated reminder rotation.
Resolve a breach — click Mark Resolved once you’ve confirmed the user has rotated their password / updated the affected account. Resolved breaches stay visible but drop out of the active count.
Change the user’s role — promotes Standard to Executive, demotes Admin to Standard, etc. The role affects the score immediately on the next recalculation.
Assign an additional course — Assign Course in the page header.
Send a phishing test now — Send Phishing in the page header.
Check what we’ve emailed them — Email Log in the page header opens their sent email history.

How risk scores work

The score is higher is better. The label translates:

Grade	Direction
A	Healthy. No intervention needed.
B	Healthy. Routine monitoring.
C	Attention needed. Investigate the user’s recent activity, consider a targeted reinforcement nudge.
D	Active intervention. Add training, run a 1:1 phishing test, get them and their manager in the loop.
F	Active intervention required. Treat this as a near-incident risk.

What moves a score

Each signal moves the score in a direction:

Failing a phishing test (click, credentials submitted, attachment opened) — score drops.
Reporting a phishing test correctly — score rises.
Completing assigned training — score rises. On-time completion is better than late completion.
Falling behind on training — score drops the longer the user is overdue.
A new dark web breach hit on the user’s email (when DWM is on) — score drops. Password exposures are treated as the most severe.
Resolving a breach — partial recovery; the user still has the historical exposure but their active score reflects the resolution.
Promoting the user to Admin / Executive / HR / Finance — recalculates with higher sensitivity for those roles. Mistakes by higher-privilege users matter more in the score.

Scores update automatically — there’s no “Recalculate Now” button to press.

You’ll know what you’re looking at when

The Overall Risk Score card’s letter grade matches the average of the per-user scores in Users at Risk.
Clicking a KPI card always lands you on the right tab with the right filter (e.g., “High Risk Users” → Users at Risk tab → High Risk filter applied).
The user counts on the Users at Risk rows match the count next to the filter chips.
The Dark Web Monitoring tab and KPI card both disappear when the feature is off for the client.

Frequently asked

A user just completed training but their score hasn’t moved yet. Scores are recalculated each time the page loads, so refresh the page first. If the score still hasn’t moved, the completion may not have been recorded yet; cross-check the Training Performance tab to confirm it.

What’s a “good” Overall Risk Score for a client? A or B is healthy — most engaged clients land there once their users have been through the initial training cycle. C signals you should check what’s pulling the average down (usually a handful of users clicking phishing tests; the High Risk filter surfaces them fast). D or F at the client level usually means brand-new or significantly behind on training.

Can I show a client how their risk has changed over time? Yes — that’s the Risk Progress report. Generate it from the Risk Progress report button on this page (last 12 months), or from the client’s Reports tab to pick a shorter period. To send it every month, turn it on under Tailor → Automated Reports — see Scheduled reports. It covers a full year from the first time you run it.

Can I export the Users at Risk list? Not directly from this view today. The closest export is the User Risk Report (Excel) — a sortable spreadsheet version of the User Risk Report — or the User Risk Report PDF, both from the Reports tab. For training detail, use the Training Status Excel report. For a custom export beyond that, the Reporting API returns the same per-user data over HTTP.

Why does one user have a different score than another with the same phishing history? Roles change how the score is calculated. An Admin or Executive with the same click history as a Standard user will have a lower score — the same misstep is more consequential for higher-privilege roles. Check the role badge on each user; if the role looks wrong, you can change it from the per-user drilldown.

A user shows clicks on the Risk page but no clicks in the activity log for that period. The Risk page rolls up the last twelve months of activity; the activity log defaults to a narrower window (the last 90 days). Widen the activity log’s date range and the clicks should appear. If they still don’t, the user may have been re-linked through a recent sync, which can split their history across two records; contact our support team.

Can I change the thresholds for what counts as High / Medium / Low risk? Not at the partner level today. The thresholds are designed to be consistent across clients so the High Risk count on your partner overview is comparable across customers. If you have a use case for per-client thresholds, contact our support team.

What happens when a client admin (the client’s own IT lead) looks at this page? The same view, scoped to their one client. They see their users’ scores, the same KPI cards, the same drilldowns. They can take the same actions (send a reminder, resolve a breach, change a role) that their dashboard role allows: an Administrator can do all of them, a Training Manager can send reminders and assign courses, and a View Only admin can look but not change anything.

Read phishing activity — the underlying phishing log feeding the score.
Dark Web Monitoring — the feature that drives the breach signals on this page.
Generate a report and use the archive — where to pull a PDF / Excel of this data for an executive review.
Reporting API — programmatic access to the same per-user risk data.