Intelligence
Human risk in three pages — who is exposed by team and group, who the riskiest people are right now, and the organization-wide score that explains it.
Overview
Intelligence is where Herd's human risk scoring comes together. In the left-hand sidebar it sits under Risk as a group with three pages:
Risk score — the organization-level roll-up: your aggregate human risk score, its trend, the recent corrections Herd assigned, and the factors that moved it.
Team risk — risk rolled up by team (each manager's direct reports) and by group, so you can compare departments and drill into any of them.
User risk — the riskiest people in your organization right now.
Clicking Intelligence lands on Risk score. All three pages need the User View permission. Team risk and User risk are part of the Enterprise plan; on other plans those two rows are hidden or shown locked with an upgrade prompt, and Risk score stays available.
Every Intelligence page shows a Risk levels legend near the top: Low 0–24, Medium 25–49, High 50–74, and Critical 75–100. It reads the same thresholds the scoring engine uses, so the bands always match the scores beside them. The same legend sits under the score gauge on a user's risk profile.
Team risk
Team risk rolls individual risk scores up into org, team, and group views, so you can see where risk concentrates without reading every profile:
Whole organization — the share of your people at High or Critical risk, headcount and assessed counts, the average score, and a breakdown by risk band.
Teams by risk — a table of managers with People, High exposure, % at risk, and Avg score. Click a row to open a Team risk side panel with This team, the per-person Reports list (riskiest first; people not yet scored show Not assessed), and the team's Top risk drivers.
Groups by risk — the same roll-up per group (People, % at risk). Click a row to open a Group risk side panel with This group, what's driving it, and its Riskiest members.
To avoid identifying individuals, cohorts smaller than 5 people are suppressed from the tables and drill-downs.
The same dashboard is also available under the Risk tab of the Reports hub.
User risk
User risk lists the riskiest people in your organization right now, each with their score, risk band, and role exposure, linking through to their own risk profile in the Directory.
Role exposure is a second axis reported beside the score: it describes a person's blast radius rather than their behaviour, so it never changes the risk score itself. Someone shows Elevated exposure when they hold privileged access or are on the high-value ERP target list (wire transfer, payment release, or vendor master); otherwise they show Standard exposure. The same Role exposure tile appears in the Risk breakdown on a user's profile.
Risk score
Risk score (in beta) is your organization's human risk score, the factors moving it, and where to invest:
The organization-level score out of 100 (lower is better) with its trend over time.
Recent corrections — the just-in-time trainings and nudges Herd's rules sent recently, when there are any, each labelled with the behaviour that triggered it. Besides failed quizzes, failed phishing simulations, and DLP flags, a correction can now be fired by a risky act in a connected tool: Committed a secret to GitHub, Bypassed GitHub push protection, Force-pushed a GitHub default branch, or Removed an Okta MFA factor (a person removing their own factor, not an admin reset). These use the GitHub and Okta connections you already have, and the nudge goes to the person over Slack or Teams. The panel's Trigger rules link opens the tile where you can require approval before a rule's corrections go out.
Risk factors — the five categories (Phishing & social engineering, Training & compliance, Access & identity, Security alerts, AI usage). Each factor has two buttons that open a side drawer: What's behind it lists the event types feeding the factor, and Who's affected shows the teams and the top people driving it.
What moved the scores — the five most recent score-moving events of the last 30 days: who, what happened, which factor, how many points, and when. See all N events opens a drawer with the full table, where you can filter by factor and time window and Export CSV.
How scoring works, beside the legend at the top of the page, opens a drawer explaining how the score is calculated.
The same score, with its trend, is available as the Human Risk Score widget on the Dashboard.
Risk settings (risk appetite)
Users holding the risk-configuration permission see a round Risk settings button on each Intelligence page (and on the Reports hub's Risk tab). It opens a drawer for tuning how risk scores are computed for your organization:
Risk appetite — five sliders, one per risk category (Phishing & social engineering, Training & compliance, Access & identity, Security alerts, AI usage), each ranging ×0.0 (ignore) to ×3.0 with a default of ×1.0. Each weight multiplies the impact of every event in that category — a bank might weight phishing harder than AI usage; a design studio the reverse.
Live preview — before saving, a "Preview: who moves before anything is saved" panel shows how the average score shifts and how many people would change risk band under the new weights.
Changes apply to everyone on the next nightly recompute; Reset to defaults restores ×1.0 across the board.
Under the hood, risk scores also net positive (risk-lowering) evidence against negatives within each category rather than globally — so completing trainings can offset training-related risk, but can't paper over a run of phishing failures. When Herd's scoring model itself is upgraded, a user's trend chart marks the version boundary rather than pretending old and new scores are directly comparable.
Related
Threat Feed — the other page under Risk in the sidebar: real-world attacks and reported phishing, ranked for your organization.
Users — each person's own risk profile, drivers, and recommended actions.
Last updated