> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/intelligence/intelligence.md).

# Intelligence

Human risk in five pages — the organization-wide score, who is exposed by team and group, who the riskiest people are, where training and simulations don't reach, and remediating the people at highest

## Overview

**Intelligence** is where Herd's human risk scoring comes together. In the left-hand sidebar it sits under **Risk** as a group with five pages:

* **Risk score** — the organization-level roll-up: your aggregate human risk score, its trend, the recent corrections Herd assigned, and the factors that moved it.
* **Team risk** — risk rolled up by team (each manager's direct reports) and by group, so you can compare departments and drill into any of them.
* **User risk** — the riskiest people in your organization right now.
* **Coverage** — which compliance frameworks and simulation channels reach your people, with each gap named.
* **Remediation** — send a training and a simulation to everyone at or above a risk level, then track how their scores move.

Clicking **Intelligence** lands on **Risk score**. All five pages need the **User View** permission. **Team risk**, **User risk**, **Coverage** and **Remediation** are part of the **Enterprise plan**; on other plans those rows are hidden or shown locked with an upgrade prompt, and **Risk score** stays available.

Every Intelligence page shows a **Risk levels** legend near the top: **Low** 0–24, **Medium** 25–49, **High** 50–74, and **Critical** 75–100. It reads the same thresholds the scoring engine uses, so the bands always match the scores beside them. The same legend sits under the score gauge on a user's risk profile.

{% hint style="info" %}
Team Risk used to be a view on the Users page, and briefly a **Risk profiles** page. Both old locations redirect here. Per-user scores and drivers still live on each person's profile in the [Directory](/herd-security-docs/users/users.md#a-users-profile).
{% endhint %}

***

## Team risk

**Team risk** rolls individual risk scores up into org, team, and group views, so you can see where risk concentrates without reading every profile:

* **Whole organization** — the share of your people **at High or Critical risk**, headcount and assessed counts, the average score, and a breakdown by risk band.
* **Teams by risk** — a table of managers with **People**, **High exposure**, **% at risk**, and **Avg** score. Click a row to open a **Team risk** side panel with **This team**, the per-person **Reports** list (riskiest first; people not yet scored show **Not assessed**), and the team's **Top risk drivers**.
* **Groups by risk** — the same roll-up per group (**People**, **% at risk**). Click a row to open a **Group risk** side panel with **This group**, what's driving it, and its **Riskiest members**.

To avoid identifying individuals, cohorts smaller than **5 people** are suppressed from the tables and drill-downs.

The same dashboard is also available under the **Risk** tab of the [Reports hub](/herd-security-docs/reports/reports.md#risk).

***

## User risk

**User risk** lists the riskiest people in your organization right now, each with their score, risk band, and **role exposure**, linking through to their own risk profile in the Directory.

**Role exposure** is a second axis reported beside the score: it describes a person's blast radius rather than their behaviour, so it never changes the risk score itself. Someone shows **Elevated exposure** when they hold privileged access or are on the high-value ERP target list (wire transfer, payment release, or vendor master); otherwise they show **Standard exposure**. The same **Role exposure** tile appears in the **Risk breakdown** on a user's profile.

***

## Risk score

**Risk score** (in beta) is your organization's human risk score, the factors moving it, and where to invest:

* The organization-level **score out of 100** (**lower is better**) with its trend over time.
* **Recent corrections** — the just-in-time trainings and nudges Herd's rules sent recently, when there are any, each labelled with the behaviour that triggered it. Besides failed quizzes, failed phishing simulations, and DLP flags, a correction can now be fired by a risky act in a connected tool: **Committed a secret to GitHub**, **Bypassed GitHub push protection**, **Force-pushed a GitHub default branch**, or **Removed an Okta MFA factor** (a person removing their own factor, not an admin reset). These use the [GitHub](/herd-security-docs/settings/settings/github-integration.md) and [Okta](/herd-security-docs/okta/okta-group-and-app-sync.md) connections you already have, and the nudge goes to the person over Slack or Teams. The panel's **Trigger rules** link opens the tile where you can [require approval](/herd-security-docs/trainings/getting-started-with-trainings/reviews-and-approvals.md#approving-corrections-from-trigger-rules) before a rule's corrections go out.
* **Risk factors** — six behaviours, each measured from whatever evidence your organization has connected:

  * **Social engineering**: email, SMS, WhatsApp and voice simulations, real phishing reports, and commands run from a terminal-paste simulation ([endpoint events](/herd-security-docs/settings/settings/endpoint-event-webhook.md)).
  * **Training & policy engagement**: Herd training and policies, and Docebo.
  * **Account & access hygiene**: Okta, Microsoft Entra ID and Google Workspace, for example MFA turned off, only phishable MFA, or a Google account not enrolled in 2-Step Verification ([Entra's signals](/herd-security-docs/microsoft-entra-id-azure-ad/azure-active-directory-user-and-group-sync.md#account-posture-signals) need extra read permissions), plus GitHub organization members with two-factor authentication off.
  * **Handling sensitive data**: connected AI tools, secrets committed to GitHub, and DLP alerts.
  * **Working around controls**: GitHub (push-protection bypasses, force-pushes, review hygiene) and SIEM alerts sent with a [controls event type](/herd-security-docs/settings/settings/siem-dlp-webhooks.md#behaviour-event-types).
  * **Security incidents**: other SIEM alerts and mail-provider security alerts.

  Each factor row shows chips for the sources that feed it and whether each is connected. Each factor has two buttons that open a side drawer: **What's behind it** lists the event types feeding the factor, and **Who's affected** shows the teams and the top people driving it.
* **Not measured** — a factor with no connected source shows **Not measured** instead of a 0% Low result, and names what would measure it, for example *Not measured — connect Okta, Entra ID or Google Workspace to measure*, or *run Email simulations to measure*. Where Herd has a setup page for it, the row links there (for example **Connect GitHub**) if you have the permission. On **User risk**, a factor that isn't measured reads **Not assessed** rather than 0, and a person's own score explanation says **Not measured** too. A point on the trend scored before the six factors were introduced (October 2026) says **Scored under the previous factor set** instead of a breakdown.
* **What moved the scores** — the five most recent score-moving events of the last 30 days: who, what happened, which factor, how many points, and when. **See all N events** opens a drawer with the full table, where you can filter by factor and time window and **Export CSV**.

**How scoring works**, beside the legend at the top of the page, opens a drawer explaining how the score is calculated.

The same score, with its trend, is available as the **Human Risk Score** widget on the [Dashboard](/herd-security-docs/getting-started/dashboard.md#human-risk-score).

***

## Coverage

**Coverage** shows whether your training and simulations actually reach your people, and names each gap with a link to fix it. It is counted from framework tags, your compliance campaigns' content, and assignments and completions. It does not analyse what your content teaches; a **How coverage is measured** note at the top of the page says so. Every share is out of the people active in your directory (service accounts, people on leave and people excluded from sync don't count).

* **Gaps** — every framework you use with no assigned training or track, each framework's topics with no content recorded, and each simulation channel nobody received in the last 12 months. Each gap links to the fix: **Start a campaign** for a framework or channel, or **Plan training with AI** for missing topics (it opens the [agentic campaign wizard](/herd-security-docs/campaigns/compliance-campaigns.md) with that framework picked). If you can't open the target page, the gap is still named but has no link.
* **Framework coverage** — each framework you use (through a compliance campaign that isn't cancelled, or a training or track tagged with it), marked **Covered** when its content is assigned to at least one person, with the share of active people who completed it. Underneath, its topics are listed as **content recorded** or **no content recorded**.
* **Simulation coverage** — for each channel your plan includes (email, SMS, voice, and WhatsApp where available), the share of active people sent a simulation in the last 12 months.

{% hint style="info" %}
Topics are recorded only for training and tracks that came through an AI compliance plan. A training you tagged with a framework by hand counts for the framework, but not for its topics, so **no content recorded** is not proof of a gap.
{% endhint %}

Framework rows need the **View compliance** permission as well; without it, Coverage lists only simulation channels, and only those whose results you can view.

***

## Remediation

**Remediation** is where you act on risk and check that it worked. The page has three panels:

* **Fix first** — the people to act on first. A person's risk level is raised one band for elevated role exposure and two for critical, without changing their risk score. **See everyone** opens **User risk**.
* **Remediate** — pick **High and above** or **Critical only** and Herd shows how many people are at that level and how many will be remediated. Each person gets a training and a phishing simulation chosen from the risk factor that scores highest for them, grouped by that factor. Pick the **Email phishing template** every group gets, and optionally **Also send an SMS phish to the phishing group** and **Call the Voice & deepfake group with a voice simulation** (calls are placed during business hours; anyone who can't be called gets the email phish). You can change the training or email phish for any group. The panel lists anyone **Skipped** because they are already in an open run, and anyone who already has the training they'd get and will retake it (their progress, or completion and certificate, resets). Click **Remediate N people** to confirm.
* **Remediated in the last 30 days** — everyone remediated recently with their **Baseline** score, their score **Now**, the **Change**, and whether they finished the **Training**, plus how many improved, held, or worsened. Scores update overnight, so someone remediated today shows no change yet.

A run is one-time: people who reach the level later are not added, and someone stays in a run for 30 days before they can be remediated again. Trainings go out after anything a person is already working through, and simulations send at the next business-hours window. To remediate you need permission to assign training and manage phishing campaigns; picking a Herd catalog training (which adds it to your library) also needs permission to create trainings.

***

## Risk settings (risk appetite)

Users holding the risk-configuration permission see a round **Risk settings** button on each Intelligence page (and on the Reports hub's Risk tab). It opens a drawer for tuning how risk scores are computed for your organization:

* **Risk appetite** — one slider per risk factor (**Social engineering**, **Training & policy engagement**, **Account & access hygiene**, **Handling sensitive data**, **Working around controls**, **Security incidents**), each ranging **×0.0 (ignore)** to **×3.0** with a default of ×1.0. Each weight multiplies the impact of every event in that factor — a bank might weight social engineering harder than sensitive-data handling; a design studio the reverse. A factor that isn't measured has its slider turned off, with the same *Not measured* line beneath it. Weights you set under the old categories carried over to the new factors; a separate Voice & deepfake weight did not, since voice is now part of Social engineering.
* **Live preview** — before saving, a **"Preview: who moves before anything is saved"** panel shows how the average score shifts and how many people would change risk band under the new weights.
* Changes apply to everyone on the **next nightly recompute**; **Reset to defaults** restores ×1.0 across the board.

Under the hood, risk scores also net positive (risk-lowering) evidence against negatives **within each category** rather than globally — so completing trainings can offset training-related risk, but can't paper over a run of phishing failures. Voice simulations are part of **Social engineering** again, so passing a voice simulation offsets an email phishing click, and the other way round. When Herd's scoring model itself is upgraded, a user's trend chart marks the version boundary rather than pretending old and new scores are directly comparable.

***

## Related

* [Threat Feed](/herd-security-docs/settings/settings/threat-feed.md) — the other page under **Risk** in the sidebar: real-world attacks and reported phishing, ranked for your organization.
* [Users](/herd-security-docs/users/users.md) — each person's own risk profile, drivers, and recommended actions.