A human risk score is a single number that rates how likely one person is to cause a cyber incident — built from their training results, phishing simulation behaviour and real-world reporting. Cyber Aware calculates a Human Risk Score for every learner and rolls it up by team, so you can see who needs attention before an incident happens, not after.
Key takeaways
- A human risk score is a per-employee number built from four inputs: course completion, quiz results, phishing simulation clicks and reporting behaviour.
- On Cyber Aware's scale, a higher Human Risk Score means more risk — an overdue course or a failed quiz pushes it up; completions and phishing reports pull it down.
- Scores are directional. The trend and the outliers carry the information, not the raw digits.
- The score only moves if the programme behind it runs: monthly modules and simulations, like Cyber Aware's training library.
How is a human risk score calculated?
No vendor publishes its exact weights, but the same four signals drive every score:
| Input | What it captures | Effect on the score |
|---|---|---|
| Course completion | Whether assigned modules finish on time | Overdue courses raise the score |
| Quiz results | Whether the material was understood, not just opened | Failed quizzes raise the score |
| Phishing simulations | Clicks and entered credentials in safe test emails | Every click raises the score |
| Reporting behaviour | Use of the phishing report button on real email | Reports lower the score |
Cyber Aware's Human Risk Score re-computes as events land: a course going overdue pushes the learner's score up the day it lapses, and a report of a real phishing email pulls it down the moment the report is logged. That makes it a live risk indicator rather than a monthly report card.
Human risk score vs phishing click rate
A click rate is one input. A human risk score is the whole picture:
- Click rate tells you how many people fell for a simulation this month. It says nothing about whether they completed training, passed the quiz or reported the email.
- Report rate rewards the behaviour you actually want — employees who flag suspicious mail before clicking. A falling click rate paired with a rising report rate is the healthiest pattern a programme can show.
- Completion and quiz data separate the staff who were trained and still clicked from the staff who were never trained at all. The first group needs better content; the second needs the course assigned.
The score bundles all four so a single number per learner can drive action. KnowBe4's 2026 Phishing by Industry Benchmarking Report puts the global baseline phish-prone rate at 33.2% before training, falling to 4.2% after 12 months — a 79% reduction. Behaviour data like that only becomes manageable once it is per-person and current.
What the score is used for
- Prioritising follow-up. The learners with the highest scores are your next coaching conversation — remediation can be assigned straight from the score rather than guessed.
- Reporting upward. A branded PDF of completion, engagement and risk gives a board or client a one-page view without exposing individuals.
- Proving compliance. Frameworks such as Essential Eight expect evidence that staff are trained and tested; the score and its underlying events are that evidence.
What a good human risk score looks like
There is no universal pass mark. Watch three things instead:
- The 90-day trend. A score moving the wrong way across a quarter is the signal — a single month's number is noise.
- The outliers. The two or three highest-risk people usually carry most of the actionable risk. Fix them and the average follows.
- Behaviour against training. Cyber Aware's published benchmark is an average 80% reduction in clicked links within eight months of monthly simulations. If clicks stay flat while completion is high, the content is not landing — shorten it, do not add more of it.
Limits of a human risk score
- It measures observed behaviour only. Someone who has never been sent a simulation looks perfect.
- It is sensitive to programme design: an empty assignment schedule produces a deceptively good score.
- It is not a guarantee. A low score lowers the odds of an incident; it does not make one impossible.
Used properly, the score is a steering wheel, not a grade. Pair it with the reporting behind Human Risk Reporting and it tells you where to spend the next month.
FAQ
How is a human risk score calculated? From four behaviour signals: course completion, quiz results, phishing simulation clicks and reporting activity. Cyber Aware raises the score for overdue courses, failed quizzes and simulation clicks, and lowers it for completions and phishing reports.
Is a higher or lower human risk score better? Lower is better — a higher score means more risk. Vendors differ on direction, so check the scale before presenting scores to a board.
How often does a human risk score update? Continuously. It re-computes whenever a course goes overdue, a quiz fails, a simulation click lands or a phishing email is reported.
Can a human risk score replace a security audit? No. It covers human risk — the events training and simulation produce. Technology controls, patching and configuration still need their own check.