Users & Groups
Browse everyone in your organization, dig into an individual user's profile and risk, and organize people into groups.
Overview
The Users area is your directory of everyone in your organization. From here you can see who's enrolled, how they're doing on trainings and phishing simulations, how risky each person is, and how they're organized into groups.
To open it, click Users in the left-hand sidebar. The area has three views, switchable at the top of the page:
People — the full user list.
Groups — your groups and how members are sourced.
Team Risk — org, team, and group risk roll-ups (see Team Risk below).
The user list
The People view lists every user with these columns:
Name — the person's display name and avatar.
Groups — the groups they belong to. Each group shows a small source badge (Okta, Slack, Google, or Herd); the list shows the first couple and a +N more when there are additional groups.
Role — their role badge (Admin, Operator, or Member).
Department — pulled from their Okta profile or Google Workspace organization, when available.
Risk — their risk band (Low, Medium, High, or Critical) from the nightly risk assessment, or
—if not yet assessed.Security Signal — the user's most recent SIEM security event as a severity badge (Critical, High, Medium, or Low), with a count when there's more than one event in the last 30 days. Requires a connected SIEM source (for example, the Splunk integration); shows
—otherwise.Trainings — the number of trainings assigned to them.
Searching and filtering
Search by name or email.
Filters (under the Filters button):
Users Assigned Trainings — show only users who currently have trainings assigned.
Show Inactive Users — include deactivated users, which are otherwise hidden. Deactivated users appear dimmed with a tooltip noting they've been deactivated.
You can sort by Name or Trainings by clicking the column header, and adjust how many rows appear per page (10, 25, 50, or 100).
A user's role comes from the role-and-group model. To change what someone can do, adjust their role or group membership — see Managing Roles, Groups, and Permissions.
User settings (default group for new users)
The Users page has its own settings drawer: click the gear icon in the page header (visible to admins and Operators with the Org Permissions permission) or open /users?settings directly.
It holds Default Group for New Users (Beta): when a user first logs into the web app, they're promoted to Operator and automatically added to the group you choose here. That group's permissions determine what the new Operator can access.
The default is None, which means new users who log in have no permissions until an admin adds them to a group.
If no default group is set, new web users start with no access at all. See Managing Roles, Groups, and Permissions for how to choose a sensible default.
A user's profile
Click any user to open their profile. The header shows their photo, name, email, when they were created, when they were added to Herd, and when they were last active — along with any account status badges (for example, if a linked Teams, Okta, or Google account has been removed).
The profile is organized into tabs. Profile is the default tab; which of the rest appear depends on the data Herd has for that person:
Profile — the user's risk profile and what's driving their risk score. On the Enterprise plan this shows the numeric score out of 100 (lower is better) with a trend chart, a Risk breakdown across five categories (Phishing & social engineering, Training & compliance, Access & identity, Security alerts, AI usage), a What's driving this score list of events that increase or reduce risk (including whether mandatory training was completed on time, late, or is overdue), and an AI-written risk assessment with recommended actions. On other plans you see the qualitative risk band and top concern, with an upgrade prompt for the full breakdown. When a SIEM source is connected, a Recent security events panel lists the user's latest security events, each with its severity, alert type, source, and timestamp.
Trainings — every training assigned to the user, with completion status and a stats summary. When learner profiling is enabled for your organization, a How they learn card also appears here — see Individualized Trainings.
Simulations — the user's phishing simulation results.
Awards — the user's completion awards, with download and re-send actions.
Slack — Slack account details (shown when the user is linked to Slack).
Teams — Microsoft Teams account details (shown when the user has Teams data).
Okta — the user's Okta group memberships (shown when present).
Google — the user's Google Workspace group memberships (shown when present).
Azure AD — the user's Azure AD / Entra details (shown when present).
From a user's training, you can send a nudge to remind them about an outstanding assignment, with the option to respect or bypass your business-hours setting.
For a fuller walk-through of an individual's compliance and acknowledgement history, see the User Page.
Service accounts
Directories almost always contain non-human accounts — bots, integrations, shared automation logins. Herd lets you mark these as service accounts so they stop skewing your program: marked accounts stop receiving trainings, phishing simulations, and nudges, are excluded from dynamic groups (including "everyone"-style groups), and no longer count toward engagement or completion metrics — including "not started" lists.
Nothing is deleted: unmarking an account restores it with its history intact.
Managing service accounts
Go to Settings (main tab) and find the Service accounts tile. From there:
Auto-detection — a dropdown controlling how Herd flags likely service accounts, with three modes: On (auto-mark & suggest), Suggest only (the default), and Off. Detection runs on every directory sync — Okta, Entra ID, Google Workspace, HRIS, Slack, and Teams. Only signals an admin explicitly authored in the provider (like Okta's user type) can auto-mark; name-pattern matches are always suggestions. Users matched to your HRIS are treated as proven humans and never suggested.
Manage service accounts — opens a dialog with a Marked list and a Suggested list. Review suggestions and use Select all, Mark as service accounts, or Not service accounts to resolve them in bulk. Suggested accounts remain fully active until you confirm them.
You can also mark or unmark an individual account from their user profile.
With auto-detection in Suggest only (the default), nothing changes without an admin's confirmation — suggestions just queue up quietly in the Settings tile for review.
Groups
Switch to the Groups view (or go to Users → Groups) to manage how people are organized. Groups drive training and campaign assignment, and — for Operators — determine permissions.
Groups display as cards or in a table (toggle between the two), and you can search groups by name. Each group shows its name, optional description, member count, and created date. Special groups are flagged:
Smart — a group automatically built from phishing failures.
Dynamic — a group whose membership is defined by rules.
Group sources
Groups can come from several sources, each labeled with its own badge:
Herd — groups you create and manage directly in Herd (green badge).
Okta — synced from Okta. Okta groups can be Okta-managed, app-sourced, or built-in.
Slack — synced from Slack.
Google — synced from Google Workspace.
Azure AD — synced from Microsoft Entra ID (Azure AD).
Groups synced from an identity or messaging source mirror that system; their membership is managed where it originates. Herd-managed groups are the ones you build and edit inside Herd.
Creating a Herd group
Create a group to fill in:
Name (required) and an optional Description.
Members — search for and add individual users. You can also add entire synced groups (Okta, Google, Slack, or Azure) as members, so a Herd group can roll up several directory groups.
Permissions (optional) — apply a permission template so members who are Operators inherit the right access.
Dynamic and smart groups
Beyond static membership, Herd offers two automatic group types:
Dynamic groups — membership is determined by rules you define (an AND/OR combination of conditions on attributes like email, role, or department). Membership updates automatically as users match or stop matching the rules.
Smart groups — built from phishing failures for a chosen month, automatically capturing the users who clicked.
Auto-assigned training
Synced groups can have a training auto-assigned to them, so every member — and any new member added to that group in the source system — receives it. In the synced-groups view, the Auto-assigned training column shows whether a group has an auto-assigned training or None.
When configuring a group auto-assignment, a Mandatory by default toggle marks the assignments the rule creates (now and for future members) as mandatory, with an optional Passing score — existing assignments are unchanged. The same default exists on tracks and on compliance campaign items.
Groups are also where Operator permissions live. For the full picture of how roles, groups, and permissions fit together, see Managing Roles, Groups, and Permissions.
Team Risk
The Team Risk view (Users → Team Risk) rolls individual risk scores up into org, team, and group views, so you can see where risk concentrates without reading every profile:
Whole organization — the share of your people at High or Critical risk, headcount and assessed counts, the average score, and a breakdown by risk band.
Teams by risk — a leaderboard of managers by their team's % at risk and average score. Click a manager to drill into This team and a per-person Reports table (people not yet scored show Not assessed).
Groups by risk — the same roll-up per group, with a drill-down into This group.
To avoid identifying individuals, cohorts smaller than 5 people are suppressed from the leaderboards and drill-downs.
Team Risk requires the User View permission and is part of the Enterprise plan — on other plans the tab shows an upgrade prompt.
Last updated