What Is Virtual Risk Officer (VRO)?

Our Virtual Risk Officer (VRO) feature provides actionable data and metrics to help you better understand your organization’s security strengths and weaknesses. You can use VRO to learn which users may be more vulnerable to phishing attacks and review the effectiveness of your security awareness training program.

VRO assigns dynamic Risk Scores to your users, groups, and organization. You can use these Risk Scores to make data-driven decisions for your organization's security.

For more information about VRO, use the links below to navigate to specific sections of this article or watch our Virtual Risk Officer (VRO) video.

Jump to:
What Is a Risk Score?
How Is Personal Risk Score Determined?

• Personal Risk Score Charts and Graphs

Group Risk Scores
Organization Risk Scores
How to Lower Risk Scores

• How to Lower Personal Risk Scores
• How to Lower Group and Organization Risk Scores

Frequently Asked Questions (FAQs)

What Is a Risk Score? 

KnowBe4 records a unique Risk Score for each of your users, your groups, and your organization. The risk score for your individual users is known as their Personal Risk Score. These Personal Risk Scores are used to calculate the Risk Score for groups and for your organization.

You can see these scores throughout your console on various reports, user lists, and group lists.

Back to top

How Is Personal Risk Score Determined?

The Personal Risk Score is a user’s individual Risk Score. Personal Risk Scores are calculated using a deep learning neural network that combines several different factors. Some of these factors are listed in the table below:

Your users’ Personal Risk Scores may vary based on these factors. For example, users in the Accounting Department may have higher Personal Risk Scores than users in the Graphic Design Department. Users in the Accounting Department have access to sensitive financial information and are more likely to be targeted with phishing or social engineering attacks.

Similarly, a CEO may have a higher Personal Risk Score than a Marketing Director. Executives may have access to classified information about the organization and may be at greater risk of social engineering attacks.

All Personal Risk Scores are updated once per day. Scores recorded on previous days can’t be changed.

You can view a user's Personal Risk Score in several areas of your console, including the Users List on the Users tab, on individual user profiles, and on User Report Cards available in the Reporting Center.

Back to top

Personal Risk Score Charts and Graphs

From the Users tab of your KnowBe4 console, there are three different graphs that show a user's Personal Risk Score. To view these graphs for each user, navigate to the Users tab, then click the user’s name.

Click a tab below to learn more about each graph:

Back to top

Group Risk Scores

A group’s Risk Score is determined by the Personal Risk Scores of users within the group and calculated by mean squared error measurement, or MSE. If a user has an unusual Personal Risk Score, MSE will prevent their score from skewing the Risk Score for the group. For example, a user with an unusually high Personal Risk Score will have less impact on the group’s Risk Score if the rest of the users in the group have low Personal Risk Scores. As a result, your groups’ Risk Scores will vary and will not be an exact average of all users' Personal Risk Scores.

The group’s Risk Score will change if users are added to or removed from the group and when the users’ Personal Risk Scores change. If changes are detected, the group’s Risk Score will be updated overnight. Risk Scores recorded in the past can’t be changed.

If you’d like, you can apply a Risk Booster to a group. For more information on how to apply a Risk Booster to a group, see our Risk Boosters Guide.

You can find the group's Risk Score in several areas of the console, including the group’s overview page, within individual group profiles, and on Group Report Cards.

Back to top

Organization Risk Scores

Your organization’s Risk Score is determined by combining all your users’ Personal Risk Scores.

However, KnowBe4 uses mean squared error measurement, or MSE, to calculate your organization’s Risk Score. If a user has an unusual Personal Risk Score, MSE will prevent that user’s score from skewing the Risk Score for your organization. For example, a user with an unusually high Personal Risk Score will have less impact on your organization’s Risk Score. As a result, your organization’s Risk Score will not be an exact average of all users' Personal Risk Scores.

You can view your organization’s Risk Score on the Dashboard tab of your KnowBe4 console. In the Organization’s Risk Score section, you can view your organization’s Risk History graph and Risk Score scale. The Risk History graph displays your organization’s Risk Score over the last six months. Each data point on the graph represents your organization’s Risk Score at that specific point in time.

Dashboard: Organization Risk

Your organization's Risk Score changes when your users’ Personal Risk Scores change. The Risk Score will be updated overnight if changes are detected.

If Risk Score changes aren't detected, you will still see at least two data points added to your organization's Risk Score graph each month. If changes aren’t detected, these two points will still be added to show that the Risk Score remained the same for the month. If your organization’s Risk Score changes, a data point will be added overnight. You cannot manually change Risk Scores recorded on the graph.

You cannot apply a manual Risk Booster to your organization’s Risk Score.

Back to top

How to Lower Risk Scores

You can lower Personal Risk Scores, group Risk Scores, and organization Risk Scores. For information about lowering these scores, see the sections below.

Back to top

How to Lower Personal Risk Scores

Some users will always have a high Personal Risk Score based on their job title or other factors. However, users can take specific actions to lower their Personal Risk Score, such as completing security awareness training and not clicking phishing links in phishing emails.

A user’s Personal Risk Score will decrease when the user completes security awareness training assignments. We recommend that you assign training modules that cover a variety of security awareness topics, such as our Kevin Mitnick Security Awareness Training module. For more information about creating a training campaign, see our Creating and Managing Training Campaigns article.

A user’s Personal Risk Score will also decrease if they don’t click phishing links or open attachments in phishing emails. When users stop clicking simulated phishing links, they will decrease their Phish-prone Percentage. Decreasing the Phish-prone Percentage will also decrease the Personal Risk Score.

Back to top

How to Lower Group and Organization Risk Scores

Your groups’ and organization’s Risk Scores will decrease as your users' Personal Risk Scores decrease. To see your organization’s Risk Score decrease over time, we recommend that you use a combined program of simulated phishing and security awareness training.

For the best results, we recommend that you follow an Automated Security Awareness Program (ASAP). This program will be customized to meet your organization’s needs and will help you stay on track with your security plan.

For more information, see our Best Practices Guide: How Do I Effectively Integrate KnowBe4 Into My Organization?. If you would like additional help, contact your Account Manager or Customer Success Manager.

Back to top

Frequently Asked Questions (FAQs)

Q: If I delete a training campaign or a phishing campaign, will my users’ Risk Scores be affected?

• A: Previous Risk Scores will not be affected. However, if you delete a campaign today, your users’ Risk Scores for today’s date and future dates will be affected.

Q: Are Security Hints and Tips and Scam of the Week campaigns included in my users’ Personal Risk Scores?

• A: Yes, these campaigns are included in your users’ Personal Risk Scores. These campaigns will lower your users’ Personal Risk Scores because they do not contain phishing links for users to click. You should always hide these campaigns from reports. For more information, see our How to Hide a Phishing Campaign from Reports article.

Q: Can I manually change a user’s Risk Score or a group’s Risk Score?

• A: Yes, you can change a user’s Risk Score or a group’s Risk Score. For more information, see our Risk Booster Guide.

Q: What time are Risk Scores updated?

• A: Risk Scores are updated around 12:00 AM Eastern Standard Time (EST). This time may vary slightly.

Q: How often is the VRO model updated?

• A: The VRO model is updated weekly. We also update this feature as needed to provide you with accurate information.

Q: Why does my organization's Risk Score display a value of 0?

• A: Your organization's Risk Score may not have been recorded yet. Risk Score values will be recorded at approximately 12:00 AM Eastern Standard Time (EST).

Back to top