.svg)
.svg)
.svg)
.svg)
.svg)
The UAE Cyber Security Council said in April 2026 that more than 75 percent of cyber breaches begin with phishing emails or fraudulent messages. Security teams read that and want a human risk score for everyone who might open one. This guide is for CISOs and GRC leads who need to know what goes into a human risk score and what the business should do when it moves.
In short: A human risk score is a per-person number built from observed behavior, role and exposure. It earns its place only when a rising score triggers a defined response, such as a harder simulation, targeted training or a tighter control.
What a Human Risk Score Measures
The Council's figure of more than 75 percent, reported by Gulf Today, shows how often a breach starts in an inbox. It does not show which inboxes carry the most risk. An employee cyber risk score answers that second question by estimating how likely one person's next decision is to let an attacker in, and how much damage follows if it does.
The likelihood half comes from behavior. The damage half comes from role and access, so the accounts payable approver who can release a payment scores differently from a colleague with the same click history and no payment rights. Human risk scoring combines both halves and keeps them current. Verizon's 2026 Data Breach Investigations Report says the most frequent causes of breaches continue to heavily involve the human element.
For how scoring sits inside a wider program, and how that differs from annual training, read our comparison of human risk management and security awareness training. This guide stays on the mechanics of the score itself.
Inputs That Belong in the Score
Start with signals you can observe without guessing. Each one should trace back to an event, so that when a manager asks why a score moved, there is a real answer.
- Simulation outcomes. Clicks, credential entry and attachment opens, weighted by how convincing the lure was.
- Reporting behavior. Whether the person reports suspicious messages, and how quickly.
- Repeat behavior. The same mistake across several campaigns, not a single slip.
- Training activity. Completion, and how the person performs in later simulations.
- Role and exposure. Access to payments, customer data, admin rights or executive calendars.
Difficulty matters because a click on an obvious lure and a click on a convincing one are different events. Reporting matters because a person who reports quickly protects the organization even after a mistake. That is why Fraus Whitebait tracks reporting rate next to click rate.
Leave out anything that reads as a personal judgment. Job grade, tenure and guesses about personality add noise and invite disputes. NIST SP 800-50 Rev. 1, published in September 2024, includes suggested metrics and evaluation methods to regularly improve and update a learning program, and it makes a useful test for every input: can you say what it measures and what you will do about it?
How to Measure Human Risk Over Time
A single score is a snapshot. To measure human risk in a way a board will trust, track movement by group and by role over months, not one organization-wide average.
Set a baseline first. Run a mixed set of scenarios across a quarter and record each person's starting position. Then watch three things: how many people report, how fast they report, and how often the same people repeat a mistake. A falling repeat rate in a high-access group says more than a falling overall click rate.
Keep the weights simple enough to explain in one sentence per input. If a CISO cannot tell the audit committee why one team scores higher than another, the number will be ignored. Our guide to security awareness KPIs for the board shows how to turn these measures into a one-page view.
What Should Happen When a Score Rises
A score on a dashboard changes nothing by itself. The value comes from a defined response when a score crosses a line, and the response should match the cause.
- Repeated simulation failures. Move the person to scenarios matched to their role and set the next difficulty level.
- Low reporting. Assign short training on how and why to report, then retest.
- High exposure and a rising score. Escalate to the manager and consider a tighter control, such as an extra approval step on payment detail changes.
- Behavior that points to a policy gap. Ask for policy acknowledgement on the rule the person has not seen.
Fraus Odin runs this loop with continuous per-employee scoring, role criticality weighting, individual threat profiles and automatic escalation. Its agentic AI recommends or assigns training, policies and controls, supervised or unsupervised. The aim is for the response to reach the person while the behavior is still recent.
Scoring in UAE and GCC Organizations
Regional context changes the design. Staff read and work in Arabic and English, so a simulation or training module in only one language partly measures comprehension rather than behavior. A score is fair only when everyone receives content they can read comfortably.
Decide early where the score data will live, because a score is personal data about an employee's behavior. Fraus can be hosted on UAE or GCC servers or deployed fully on-premise, and it is available in Arabic and English.
Agree who sees individual scores as well. A practical rule is to show named scores to the employee and their manager, and aggregate scores to the board. That keeps the conversation about support rather than blame.
Start With One Role Group
Go back to the accounts payable approver. Pick that group, list the five inputs above, write down the response for each threshold and run it for one quarter. By the end you will know whether the score moves for reasons you can explain to an auditor.
If you want to see scoring and escalation working across a whole workforce, Odin is where to begin.
Frequently Asked Questions
What is a human risk score?
A human risk score is a number for each employee that estimates how likely they are to make a decision that lets an attacker in, and how much harm it could cause. It combines observed behavior, such as simulation results and reporting, with role and access, and it updates as new behavior is recorded.
How do you calculate an employee risk score?
Choose a small set of observable inputs, such as simulation outcomes, reporting behavior, repeat behavior, training activity and role exposure. Weight each input, with more weight on convincing lures and on roles with payment or data access. Recalculate after every event, and keep each weight simple enough to explain to an auditor.
What are human risk scoring best practices?
Score only what you can observe, weight by role, and track reporting alongside clicks. Tie every threshold to a defined response, such as a matched simulation or targeted training. Show named scores only to the employee and manager, report aggregates to the board, and review the weights each quarter.
.png)
.png)
.png)
