> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/users/users.md).

# Users & Groups

## Overview

The **Users** area is your directory of everyone in your organization. From here you can see who's enrolled, how they're doing on trainings and phishing simulations, how risky each person is, and how they're organized into groups.

To open it, click **Users** in the left-hand sidebar. The area has three views, switchable at the top of the page:

* **People** — the full user list.
* **Groups** — your groups and how members are sourced. This tab is visible to admins and to Operators with the **Org Permissions** permission, since groups carry permissions.
* **Team Risk** — org, team, and group risk roll-ups (see [Team Risk](#team-risk) below).

***

## The user list

The **People** view lists every user with these columns:

* **Name** — the person's display name and avatar.
* **Groups** — the groups they belong to. Each group shows a small source badge (Okta, Slack, Google, or Herd); the list shows the first couple and a **+N more** when there are additional groups.
* **Role** — their role badge (Admin, Operator, or Member).
* **Department** — pulled from their Okta profile or Google Workspace organization, when available.
* **Risk** — their risk band (**Low**, **Medium**, **High**, or **Critical**) from the nightly risk assessment, or `—` if not yet assessed.
* **Security Signal** — the user's most recent SIEM security event as a severity badge (Critical, High, Medium, or Low), with a count when there's more than one event in the last 30 days. Requires a connected SIEM source (for example, the [Splunk integration](/herd-security-docs/settings/settings/siem-dlp-webhooks.md)); shows `—` otherwise.
* **Trainings** — the number of trainings assigned to them.

### Searching and filtering

* **Search** by name or email.
* **Filters** (under the Filters button):
  * **Users Assigned Trainings** — show only users who currently have trainings assigned.
  * **Show Inactive Users** — include deactivated users, which are otherwise hidden. Deactivated users appear dimmed with a tooltip noting they've been deactivated.

You can **sort** by **Name** or **Trainings** by clicking the column header, and adjust how many rows appear per page (10, 25, 50, or 100).

***

## Adding users directly (no directory required)

You don't need a directory integration to get people into Herd. Users with the **Manage Users** permission see an **Add user** button in the People header, which opens a dialog with two tabs:

* **One user** — enter a **Full name**, **Email**, and an optional **Phone number** (E.164 format, e.g. `+14255550123` — only needed for SMS simulations). New people join as **Members** and can sign in with the email you enter.
* **Import CSV** — drop or choose a CSV with the columns `email, name, phone` (only `email` is required; common header variants like *Full Name* or *Phone Number* are recognized). Up to **200 people per import**, 2 MB per file. Herd previews every row before importing, marking each as **Will import**, **Skipped** (e.g. already a user, duplicate within the file), or **Error** (e.g. invalid email or phone format), so you can fix problems before anything is created.

{% hint style="info" %}
For ongoing, automatic user lifecycle from your identity provider, use a [directory sync](/herd-security-docs/okta/okta-group-and-app-sync.md) or [SCIM provisioning](/herd-security-docs/settings/settings/scim-provisioning.md) instead — direct adds are best for small teams and one-off additions.
{% endhint %}

{% hint style="info" %}
A user's role comes from the role-and-group model. To change what someone can do, adjust their role or group membership — see [Managing Roles, Groups, and Permissions](/herd-security-docs/how-to-documentation/managing-roles-groups-and-permissions.md).
{% endhint %}

***

## User settings (default group for new users)

The Users page has its own settings drawer: click the **gear icon** in the page header (visible to admins and Operators with the **Org Permissions** permission) or open `/users?settings` directly.

It holds **Default Group for New Users** (Beta): when a user first logs into the web app, they're promoted to **Operator** and automatically added to the group you choose here. That group's permissions determine what the new Operator can access.

The default is **None**, which means new users who log in have no permissions until an admin adds them to a group.

{% hint style="warning" %}
If no default group is set, new web users start with no access at all. See [Managing Roles, Groups, and Permissions](/herd-security-docs/how-to-documentation/managing-roles-groups-and-permissions.md) for how to choose a sensible default.
{% endhint %}

***

## A user's profile

Click any user to open their profile. The header shows their photo, name, email, when they were created, when they were added to Herd, and when they were last active — along with any account status badges (for example, if a linked Teams, Okta, or Google account has been removed).

The profile is organized into tabs. **Profile** is the default tab; which of the rest appear depends on the data Herd has for that person:

* **Profile** — the user's risk profile and what's driving their risk score. On the **Enterprise plan** this shows the numeric score out of 100 (lower is better) with a trend chart, a **Risk breakdown** across five categories (Phishing & social engineering, Training & compliance, Access & identity, Security alerts, AI usage), a **What's driving this score** list of events that increase or reduce risk (including whether mandatory training was completed on time, late, or is overdue), and an AI-written risk assessment with recommended actions. On other plans you see the qualitative risk band and top concern, with an upgrade prompt for the full breakdown. When a SIEM source is connected, a **Recent security events** panel lists the user's latest security events, each with its severity, alert type, source, and timestamp.
* **Trainings** — every training assigned to the user, with completion status and a stats summary. When learner profiling is enabled for your organization, a **How they learn** card also appears here — see [Individualized Trainings](/herd-security-docs/trainings/getting-started-with-trainings/individualized-trainings.md#learner-profiles).
* **Simulations** — the user's phishing simulation results.
* **Awards** — the user's [completion awards](/herd-security-docs/trainings/getting-started-with-trainings/completion-awards.md), with download and re-send actions.

When [AI Coach](/herd-security-docs/ai-coach/ai-coach.md) is enabled, the Profile tab also carries an **AI Coach** card summarizing how effectively the person prompts AI — with a **Coach** button to generate a coaching session and, for users with the Manage AI Coach permission, an **Assign training** button that assigns an existing training off the back of the coaching signal (the person is notified the same way as any other assignment).

* **Slack** — Slack account details (shown when the user is linked to Slack).
* **Teams** — Microsoft Teams account details (shown when the user has Teams data).
* **Okta** — the user's Okta group memberships (shown when present).
* **Google** — the user's Google Workspace group memberships (shown when present).
* **Azure AD** — the user's Azure AD / Entra details (shown when present).

From a user's training, you can send a **nudge** to remind them about an outstanding assignment, with the option to respect or bypass your business-hours setting.

{% hint style="info" %}
For a fuller walk-through of an individual's compliance and acknowledgement history, see the [User Page](/herd-security-docs/compliance/user-page.md).
{% endhint %}

***

## Service accounts

Directories almost always contain non-human accounts — bots, integrations, shared automation logins. Herd lets you mark these as **service accounts** so they stop skewing your program: marked accounts stop receiving trainings, phishing simulations, and nudges, are excluded from dynamic groups (including "everyone"-style groups), and no longer count toward engagement or completion metrics — including "not started" lists.

Nothing is deleted: unmarking an account restores it with its history intact.

### Managing service accounts

Go to **Settings** (main tab) and find the **Service accounts** tile. From there:

* **Auto-detection** — a dropdown controlling how Herd flags likely service accounts, with three modes: **On (auto-mark & suggest)**, **Suggest only** (the default), and **Off**. Detection runs on every directory sync — Okta, Entra ID, Google Workspace, HRIS, Slack, and Teams. Only signals an admin explicitly authored in the provider (like Okta's user type) can auto-mark; name-pattern matches are always suggestions. Users matched to your HRIS are treated as proven humans and never suggested.
* **Manage service accounts** — opens a dialog with a **Marked** list and a **Suggested** list. Review suggestions and use **Select all**, **Mark as service accounts**, or **Not service accounts** to resolve them in bulk. Suggested accounts remain fully active until you confirm them.

You can also mark or unmark an individual account from their user profile.

{% hint style="info" %}
With auto-detection in **Suggest only** (the default), nothing changes without an admin's confirmation — suggestions just queue up quietly in the Settings tile for review.
{% endhint %}

***

## Groups

Switch to the **Groups** view (or go to **Users → Groups**) to manage how people are organized. Groups drive training and campaign assignment, and — for Operators — determine permissions.

Groups display as cards or in a table (toggle between the two), and you can **search** groups by name. Each group shows its name, optional description, **member count**, and **created** date. Special groups are flagged:

* **Smart** — a group automatically built from phishing failures.
* **Dynamic** — a group whose membership is defined by rules.

### Group sources

Groups can come from several sources, each labeled with its own badge:

* **Herd** — groups you create and manage directly in Herd (green badge).
* **Okta** — synced from Okta. Okta groups can be Okta-managed, app-sourced, or built-in.
* **Slack** — synced from Slack.
* **Google** — synced from Google Workspace.
* **Azure AD** — synced from Microsoft Entra ID (Azure AD).

Groups synced from an identity or messaging source mirror that system; their membership is managed where it originates. Herd-managed groups are the ones you build and edit inside Herd.

### Creating a Herd group

Create a group to fill in:

* **Name** (required) and an optional **Description**.
* **Members** — search for and add individual users. You can also add entire synced groups (Okta, Google, Slack, or Azure) as members, so a Herd group can roll up several directory groups.
* **Permissions** (optional) — apply a permission template so members who are Operators inherit the right access.

### Dynamic and smart groups

Beyond static membership, Herd offers two automatic group types:

* **Dynamic groups** — membership is determined by rules you define (an AND/OR combination of conditions on attributes like email, role, or department). Membership updates automatically as users match or stop matching the rules.
* **Smart groups** — built from **phishing failures** for a chosen month, automatically capturing the users who clicked.

### Auto-assigned training

Synced groups can have a training auto-assigned to them, so every member — and any new member added to that group in the source system — receives it. In the synced-groups view, the **Auto-assigned training** column shows whether a group has an auto-assigned training or **None**.

When configuring a group auto-assignment, a **Mandatory by default** toggle marks the assignments the rule creates (now and for future members) as mandatory, with an optional **Passing score** — existing assignments are unchanged. The same default exists on [tracks](/herd-security-docs/tracks/training-tracks.md) and on [compliance campaign](/herd-security-docs/compliance/compliance-campaigns.md) items.

{% hint style="info" %}
Groups are also where Operator permissions live. For the full picture of how roles, groups, and permissions fit together, see [Managing Roles, Groups, and Permissions](/herd-security-docs/how-to-documentation/managing-roles-groups-and-permissions.md).
{% endhint %}

***

## Team Risk

The **Team Risk** view (**Users → Team Risk**) rolls individual risk scores up into org, team, and group views, so you can see where risk concentrates without reading every profile:

* **Whole organization** — the share of your people **at High or Critical risk**, headcount and assessed counts, the average score, and a breakdown by risk band.
* **Teams by risk** — a leaderboard of managers by their team's **% at risk** and average score. Click a manager to drill into **This team** and a per-person **Reports** table (people not yet scored show **Not assessed**).
* **Groups by risk** — the same roll-up per group, with a drill-down into **This group**.

To avoid identifying individuals, cohorts smaller than **5 people** are suppressed from the leaderboards and drill-downs.

The same dashboard is also available under the **Risk** tab of the [Reports hub](/herd-security-docs/reports/reports.md#risk).

{% hint style="info" %}
Team Risk requires the **User View** permission and is part of the **Enterprise plan** — on other plans the tab shows an upgrade prompt.
{% endhint %}

### Risk settings (risk appetite)

Users holding the risk-configuration permission see a **Risk settings** gear on the Team Risk page (and on the Reports hub's Risk tab). It opens a drawer for tuning how risk scores are computed for your organization:

* **Risk appetite** — five sliders, one per risk category (**Phishing & social engineering**, **Training & compliance**, **Access & identity**, **Security alerts**, **AI usage**), each ranging **×0.0 (ignore)** to **×3.0** with a default of ×1.0. Each weight multiplies the impact of every event in that category — a bank might weight phishing harder than AI usage; a design studio the reverse.
* **Live preview** — before saving, a **"Preview: who moves before anything is saved"** panel shows how the average score shifts and how many people would change risk band under the new weights.
* Changes apply to everyone on the **next nightly recompute**; **Reset to defaults** restores ×1.0 across the board.

Under the hood, risk scores also net positive (risk-lowering) evidence against negatives **within each category** rather than globally — so completing trainings can offset training-related risk, but can't paper over a run of phishing failures. When Herd's scoring model itself is upgraded, a user's trend chart marks the version boundary rather than pretending old and new scores are directly comparable.