Virtual Risk Officer (VRO) and Risk Score Guide

Our Virtual Risk Officer (VRO) feature provides actionable insights and metrics to help you better understand the attack surface of your organization. You can learn which users might be more vulnerable to a phishing attack and review the effectiveness of your security awareness training program over time.

VRO provides dynamic Risk Scores—assigned to users, groups, and your organization as a whole—to help you make data-driven decisions for your organization's security.

Use the links below to navigate to a specific topic within this article or click here to see a quick video overview of this feature.

Jump to:
What is a Risk Score?
Personal Risk Scores

• What influences Personal Risk Scores?
• Personal Risk Score Charts and Graphs

Group Risk Scores
Organization Risk Score
Risk Boosters
How to Lower Risks
FAQs

What is a Risk Score? 

KnowBe4 records a unique Risk Score for your users, groups, and organization as a whole. These scores are displayed throughout the console on various reports, as well as your users and groups lists.

Each user has a Personal Risk Score. These Personal Risk Scores are used to calculate the Risk Score for groups and for the organization as a whole.

Back to top

Personal Risk Scores

The Risk Score for a user, called the Personal Risk Score, is calculated by several different factors, including how likely the user is to be targeted with a phishing or social engineering attack, how they will react to these types of events, and how severe the consequences would be if they fell for an attack. It is normal for Personal Risk Scores to vary amongst users. 

For example, the Personal Risk Score of employees in your Accounting Department will be higher than those of employees in the Graphic Design Department, because your Accounting Department has access to sensitive financial data. Similarly, your CEO or CFO will have a higher Risk Score than a Marketing Director, because your C-level executives may have access to classified or proprietary information about the organization.

All Personal Risk Scores are updated once per day, and scores that were recorded on previous days cannot be modified.

You can find a user's Personal Risk Score in several areas of the console, including the Users List on the Users tab, on individual user profiles, and on User Report Cards available in the Reporting Center.

Back to top

What Influences Personal Risk Scores?

Personal Risk Scores are calculated using a proprietary deep learning neural network that combines a number of different factors. The factors include, but are not limited to, the below:

Back to top

Personal Risk Score Charts and Graphs

User profiles will include three different graphic reports to illustrate that user's Personal Risk Score. Click a tab below to learn more about that graph:

Back to top

Risk Booster

What are Risk Boosters?

A Risk Booster is a setting that can be manually configured by admins on your account to intentionally increase or decrease the Risk Score of any user or group. Risk Boosters will always be set to Normal unless changed by an admin.

For details on how to modify Risk Boosters, as well as use cases, see our Risk Booster Guide.

Back to top

Group Risk

A group inherits Risk Scores of the users within the group. You can find a group's Risk Score in several areas of the console, including on the Users > Groups tab, within individual group profiles, and on Group Report Cards, available in the Reporting Center.

Group Risk is calculated based on the Personal Risk Scores of users within the group. As a very basic example, a group containing two users--where one user has a Risk Score of 75 and the other has a Risk Score of 25—would have a risk score of 50.

However, this calculation will take outliers into consideration in order to avoid a skewed group score, using a mean squared error (MSE) measurement. This means that unusual user Risk Scores in the group (For example, extremely low or extremely high) will have less impact on the group Risk Score. As a result, your group Risk Scores will vary and will not be an exact average of all user Risk Scores in the group.

Group Risk Scores will update when users are added to or removed from groups or as the Personal Risk Scores of users within those groups change. Group risk scores are updated overnight if changes are detected. Risk Scores recorded in the past cannot be changed.

Back to top

Organization Risk

On the Dashboard tab of your console, the Risk Score graph will display your Organization’s Risk Score over the last six months. Each data point on the graph represents the organization’s Risk Score at that specific point in time.

Dashboard: Organization Risk

The overall Risk Score for your organization is a combination of the Personal Risk Scores of all users at your organization. The calculation will take outliers into consideration in order to avoid a skewed organization Risk Score, using a mean squared error (MSE) measurement. This means that unusual user Risk Scores in your organization (For example, extremely low or extremely high) will have less impact on the score. As a result, your organization Risk Score will vary and will not be an exact average of all of your users' Risk Scores.

Your organization's Risk Score will update as the Personal Risk Scores of your users change. Organization Risk Scores are updated overnight if changes are detected.

If Risk Score changes aren't detected, you will still see at least two data points added to your organization's Risk Score graph each month. If your organization’s Risk Score changes, an additional data point will be added overnight. Risk Scores recorded in the past cannot be changed.

Your organization’s Risk Score does not have a manual Risk Booster.

Back to top

How to Lower Risk

Lowering User Risk

Based on their job title and available breach data, some users will always have an elevated Personal Risk Score. However, there are some actions that can be taken by the user to help lower this score:

1. Complete security awareness training regularly
   • A user’s completion of security awareness training assignments will lower their Personal Risk Score. We recommend selecting training modules that are comprehensive and cover multiple facets of security awareness training.
     • Here are examples of training modules that meet this need:
       
       • Kevin Mitnick Security Awareness Training
       • KnowBe4 Security Awareness Training
     • Here are resources for how to set up training campaigns:
       • Training Campaigns: Creating Campaigns
       • Setting up a training campaign (Video)
       • One minute training campaign (Video)
2. Watch out for red flags in phishing emails and become a human firewall for their organization (i.e. lower their Phish-prone Percentage)
   • With a combined program of security awareness training and simulated phishing, your user can become a strong human firewall for your organization and prevent a successful phishing attack. Their Phish-prone Percentage indicates the likelihood they will fall for a phishing attack, based on previously-recorded behavior.
   • Users can lower this by not clicking links, opening attachments, or otherwise failing simulated phishing exercises.
     • The lower their Phish-prone Percentage, the lower their Personal Risk Score will be.

Lowering Group and Organizational Risk

The Risk Score of your groups and organization will lower as your users' risk score lowers.  Ideally, with a combined program of simulated phishing and security awareness training, you will see your organization’s Risk Score lowered over time.

For the best results, we recommend following an Automated Security Awareness Program (ASAP) that has been customized for you to review best practices and stay on track with your security plan. You can also review our Best Practices Guide for similar insight into how best to run your KnowBe4 console. If you're not getting the results you'd like, reach out to your Customer Success Manager or account manager for assistance.

Back to top

Frequently Asked Questions (FAQs)

Q: If I hide or delete a training or phishing campaign, will my user’s Risk Score be affected?

• A: Risk Scores in the past are fixed, so they will not be affected by the deletion of the campaign. If you delete a campaign today, however, your user’s Risk Score for today (and the future) will be affected.

Q: Are Security Hints and Tips and Scam of the Week campaigns included in a user’s Personal Risk Score?

• A: Yes, because these types of campaigns are sent from the Phishing area of the console, they will lower the risk of your users as they do not contain phishing links for users to click. You should always hide these campaigns from reports. Here is how.

Q: Can I manually change a user or group’s Risk Score?

• A: Yes! See our Risk Booster Guide for more information. 

Q: What time are Risk Scores actually updated?

• A: Risk Scores are updated around 12:00 AM Eastern Standard Time (EST), but this time may vary slightly.
•  

Q: How often is the VRO model updated?

• A: The VRO model is updated weekly and we make enhancements to this feature as needed throughout the year to provide you with the most accurate information.

Q: Why is my organization's Risk Score displaying a value of 0?

• A: If there is no information being displayed, your organization's Risk Score may not have been recorded yet. Risk Score values will be recorded at approximately 12:00 AM Eastern Standard Time (EST).

Back to top