Virtual Risk Officer (VRO) and Risk Score Guide

Jump to:
Introduction
What is a risk score?
User risk
Group risk
Organization risk
Risk Boosters
How to lower risk
FAQs

Introduction to Virtual Risk Officer (VRO)

KnowBe4’s Virtual Risk Officer (VRO) feature provides insight and actionable metrics that will allow you to understand the attack surface of your organization, learn which users might be more vulnerable to a phishing attack, and check in on the effectiveness of your security awareness training program over time.

VRO provides dynamic risk scores—assigned to users, groups, and your organization as a whole—helping you make data-driven decisions when it comes to your security awareness plan and understand what users are the most susceptible to a phishing attack.

To see a quick video overview of this feature, click here.

Example of an organization's risk score, displayed on the Dashboard tab:

Back to top

What is a Risk Score? 

KnowBe4 records a unique Risk Score for your users, groups, and organization as a whole. These scores are displayed throughout the console on various reports, as well as your users and groups lists.

Each user will have a Personal Risk Score. The risk score for your groups and your organization is a calculation based on the Personal Risk Scores of all of the members of that group or organization.

Back to top

User Risk: Personal Risk Score

Jump to:
What is the Personal Risk Score?
What influences Personal Risk Scores?
Where to view Personal Risk Scores
Personal Risk Score Charts and Graphs

What is the Personal Risk Score?

The risk score for a user, called the Personal Risk Score, is calculated by several different factors (detailed in the next section), including how likely the user is to be targeted with a phishing or social engineering attack, how they will react to these types of events, and how severe the consequences would be if they fell for an attack.

For example, the Personal Risk Score of employees in your Accounting Department will be higher than those of employees in the Graphic Design Department, because your Accounting Department has access to sensitive financial data. Similarly, your CEO or CFO will have a higher risk score than a Marketing Director, because your C-level executives may have access to classified or proprietary information about the organization.

All Personal Risk Scores are updated once per day, and scores that were recorded on previous days cannot be modified.

What Influences Personal Risk Scores?

Personal Risk Scores are calculated using a proprietary deep learning neural network that combines a number of different factors. The factors include, but are not limited to, the below:

Back to top

Where to View a User's Personal Risk Score

You can find a user's Personal Risk Score in several areas of the console, including the All Users list on the Users tab, within their individual user profiles, and on their User Report Cards, available in the Advanced Reporting Center.

Back to top

Personal Risk Score Charts and Graphs

User profiles will include three different graphic reports to illustrate that user's Personal Risk Score. Click below to learn more about each:

• Personal Risk Score Scale
• Risk Score - Last 6 Months
• Risk Score Factors Chart

Back to top

User Risk: Personal Risk Score Scale

The Personal Risk Score Scale provides a visual representation of the user’s calculated Personal Risk Score, which ranges from 0-100.

Below is an example of this graph, as well as what each color represents in terms of Personal Risk Score.

Back to top

User Risk: Risk Score - Last 6 Months

This line graph represents the change in the user’s Personal Risk Score over the last six months.

Example of Risk Score - Last 6 Months

Back to top

User Risk: Risk Score Factors Chart

The Risk Score Factors radar chart (or spider chart) indicates the factors that are most influencing your user's risk score. The data here is relative only to the other factors for this user, not all users in your organization.

Example of Risk Score Factors Chart

Back to top

Risk Booster

What are Risk Boosters?

A Risk Booster is a setting that can be manually configured by admins on your account to intentionally increase or decrease the risk score of any user or group. Risk Boosters will always be set to Normal unless changed by an admin.

For details on how to modify Risk Boosters, as well as use cases, see our Risk Booster Guide.

Back to top

Group Risk

Groups inherit the overall risk of the users within the group. You can find a group's risk score in several areas of the console, including on the Users > Groups tab, within individual group profiles, and on Group Report Cards, available in the Advanced Reporting Center.

Group Risk: Groups List on Users & Groups tab

Group Risk: Group Profiles

Group Risk: Group Report Cards in the Advanced Reporting Center

How is Group Risk Calculated?

Group risk is calculated based on the Personal Risk Scores of users within the group. As a very basic example, a group containing two users--where one user has a risk score of 75 and the other has a risk score of 25—would have a risk score of 50.

However, this calculation will take outliers into consideration in order to avoid a skewed group score, using a mean squared error (MSE) measurement. This means that unusual user risk scores in the group (For example, extremely low or extremely high) will have less impact on the group risk score. As a result, your group risk scores will vary and will not be an exact average of all user risk scores in the group.

Group risk scores will update when users are added to or removed from groups or as the Personal Risk Scores of users within those groups change. Group risk scores are updated overnight if changes are detected. Risk scores recorded in the past cannot be changed.

Back to top

Organization Risk

On the Dashboard tab of your console, the Risk Score graph will display your Organization’s Risk Score over the last six months. Each data point on the graph represents the organization’s risk score at that specific point in time.

Dashboard: Organization Risk

The overall risk score for your organization is a combination of the Personal Risk Scores of all users at your organization. The calculation will take outliers into consideration in order to avoid a skewed organization risk score, using a mean squared error (MSE) measurement. This means that unusual user risk scores in your organization (For example, extremely low or extremely high) will have less impact on the score. As a result, your organization risk score will vary and will not be an exact average of all of your users' risk scores.

Your organization's risk score will update as the Personal Risk Scores of your users change. Organization risk scores are updated overnight if changes are detected.

If risk score changes aren't detected, you will still see at least two data points added to your organization's risk score graph each month. If your organization’s risk score changes, an additional data point will be added overnight. Risk scores recorded in the past cannot be changed.

Your organization’s risk score does not have a manual Risk Booster.

Back to top

How to Lower Risk

Lowering User Risk

Based on their job title and available breach data, some users will always have an elevated Personal Risk Score. However, there are some actions that can be taken by the user to help lower this score:

1. Complete security awareness training regularly
   • A user’s completion of security awareness training assignments will lower their Personal Risk Score. We recommend selecting training modules that are comprehensive and cover multiple facets of security awareness training.
     • Here are examples of training modules that meet this need:
       
       • Kevin Mitnick Security Awareness Training
       • KnowBe4 Security Awareness Training
     • Here are resources for how to set up training campaigns:
       • Training Campaigns: Creating Campaigns
       • Setting up a training campaign (Video)
       • One minute training campaign (Video)
2. Watch out for red flags in phishing emails and become a human firewall for their organization (i.e. lower their Phish-prone Percentage)
   • With a combined program of security awareness training and simulated phishing, your user can become a strong human firewall for your organization and prevent a successful phishing attack. Their Phish-prone Percentage indicates the likelihood they will fall for a phishing attack, based on previously-recorded behavior.
   • Users can lower this by not clicking links, opening attachments, or otherwise failing simulated phishing exercises.
     • The lower their Phish-prone Percentage, the lower their Personal Risk Score will be.

Lowering Group and Organizational Risk

The risk score of your groups and organization will lower as your users' risk score lowers.  Ideally, with a combined program of simulated phishing and security awareness training, you will see your organization’s risk score lowered over time.

For the best results, we recommend following an Automated Security Awareness Program (ASAP) that has been customized for you to review best practices and stay on track with your security plan. You can also review our Best Practices Guide for similar insight into how best to run your KnowBe4 console. If you're not getting the results you'd like, reach out to your Customer Success Manager or account manager for assistance.

Back to top

Frequently Asked Questions (FAQs)

Q: If I hide or delete a training or phishing campaign, will my user’s risk score be affected?

A: Risk scores in the past are fixed, so they will not be affected by the deletion of the campaign. If you delete a campaign today, however, your user’s risk score for today (and the future) will be affected.

Q: Are Security Hints and Tips and Scam of the Week campaigns included in a user’s Personal Risk Score?

A: Yes, because these types of campaigns are sent from the Phishing area of the console, they will lower the risk of your users as they do not contain phishing links for users to click. You should always hide these campaigns from reports. Here is how.

Q: Can I manually change a user or group’s risk score?
A: Yes! See our Risk Booster Guide for more information. 

Q: What time are risk scores actually updated?
A: Risk scores are updated around 12:00 AM Eastern Standard Time (EST), but this time may vary slightly.

Back to top