Systems and methods for determining individual and group risk scores
View Patent ↗Embodiments disclosed herein describe a server, for example a security awareness server or an artificial intelligence machine learning system that establishes a risk score or vulnerable for a user of a security awareness system, or for a group of users of a security awareness system. The server may create a frequency score for a user, which predicts the frequency at which the user is to be hit with a malicious attack. The frequency score may be based on at least a job score, which may be represented by a value that is based on the type of job the user has, and a breach score that may be represented by a value that is based on the user's level of exposure to email.
1. A method comprising:
(a) determining, by one or more servers, a frequency score to predict a frequency at which a user is to be hit with a malicious attack;
(b) determining, by the one or more servers, a propensity score that identifies a propensity of the user to respond to the hit of the malicious attack;
(c) determining, by the one or more servers, a severity score that identifies a severity of the user's response to the hit of the malicious attack;
(d) establishing, by the one or more servers, a risk score for the user, the risk score established as a function of the frequency score, the severity score and the propensity score, wherein the function comprises one of a weighted or logarithmic function; and
(e) displaying, by the one or more servers based at least on the risk score, a probability that the user will respond to a subsequent hit of a type of malicious attack at a point in time.
2. The method of claim 1 , wherein (a) further comprise determining the frequency score based at least on a job score and a breach score.
3. The method of claim 2 , wherein the job score comprises a value identified based on a type of job.
4. The method of claim 2 , wherein the breach score comprises a value identified based on the user's level of exposure to email.
5. The method of claim 1 , wherein (b) further comprises determining the propensity score based at least on training a predictive model with an input of the user history of whether or not the user responded with a type of response for a given hit of the malicious attack.
6. The method of claim 1 , wherein (c) further comprises determining the severity score based at least on a job score.
7. The method of claim 1 , wherein (c) further comprises determining the severity score based at least on individual access of the user.
8. The method of claim 1 , further comprising establishing a group risk score based on a function of risk scores of each user within the group.
9. A system comprising:
one or more servers comprising one or more processors and configured to:
determine a frequency score to predict a frequency at which a user is to be hit with a malicious attack;
determine a propensity score that identifies a propensity of the user to respond to the hit of the malicious attack;
determine a severity score that identifies a severity of the user's response to the hit of the malicious attack;
establish a risk score for the user, the risk score established as a function of the frequency score, the severity score and the propensity score, wherein the function comprises one of a weighted or logarithmic function; and
display, based at least on the risk score, a probability that the user will respond to a subsequent hit of a type of malicious attack at a point in time.
10. The system of claim 9 , wherein the one or more servers are further configured to determine the frequency score based at least on a job score and a breach score.
11. The system of claim 10 , wherein the job score comprises a value identified based on a type of job.
12. The system of claim 10 , wherein the breach score comprises a value identified based on the user's level of exposure to email.
13. The system of claim 9 , wherein the one or more servers are further configured to determine the propensity score based at least on training a predictive model with an input of the user history of whether or not the user responded with a type of response for a given hit of the malicious attack.
14. The system of claim 9 , wherein the one or more servers are further configured to determine the severity score based at least on a job score.
15. The system of claim 9 , wherein the one or more servers are further configured to determine the severity score based at least on individual access of the user.
16. The system of claim 9 , wherein the one or more servers are further configured to establish a group risk score based on a function of risk scores of each user within the group.