Systems and methods for determining individual and group risk scores
Embodiments disclosed herein describe a server, for example a security awareness server or an artificial intelligence machine learning system that establishes a risk score or vulnerable for a user of a security awareness system, or for a group of users of a security awareness system. The server may create a frequency score for a user, which predicts the frequency at which the user is to be hit with a malicious attack. The frequency score may be based on at least a job score, which may be represented by a value that is based on the type of job the user has, and a breach score that may be represented by a value that is based on the user's level of exposure to email.
1. A method comprising:
identifying, by one or more processors, a breach score of a user based at least on the user's level of exposure to email and that decays over time;
determining, by the one or more processors, a risk score of the user based at least on the breach score and one or more values representing a frequency at which the user is expected to receive a phishing communication and a propensity of the user to interact with the phishing communication; and
using, by the one or more processors, the risk score of the user to determine an action to take.
2. The method of claim 1 , further comprising determining, by the one or more processors, the breach score based at least on the user's level of exposure to email.
3. The method of claim 1 , wherein the risk score identifies a probability of the user to interact with the phishing communication.
4. The method of claim 1 , further comprising determining, by the one or more processors, the risk score as a function of the breach score and the one or more values.
5. The method of claim 1 , further comprising determining, by the one or more processors, the risk score using a machine learning model configured to use the breach score and the one or more values as input.
6. The method of claim 1 , further comprising taking, by the one or more processors, the action to display the risk score of the user.
7. The method of claim 1 , further comprising taking, by the one or more processors, the action to provide electronic training to the user.
8. The method of claim 1 , further comprising using, by the one or more processors, the risk score of the user to establish a group risk score.
9. A system comprising:
one or more processors, coupled to memory and configured to:
identify a breach score of a user based at least on the user's level of exposure to email and that decays over time;
determine a risk score of the user based at least on the breach score and one or more values representing a frequency at which the user is expected to receive a phishing communication and a propensity of the user to interact with the phishing communication; and
use the risk score of the user to determine an action to take.
10. The system of claim 9 , wherein the one or more processors are further configured to determine the breach score based at least on the user's level of exposure to email.
11. The system of claim 9 , wherein the risk score identifies a probability of the user to interact with the phishing communication.
12. The system of claim 9 , wherein the one or more processors are further configured to determine the risk score as a function of the breach score and the one or more values.
13. The system of claim 9 , wherein the one or more processors are further configured to determine the risk score using a machine learning model configured to use the breach score and the one or more values as input.
14. The system of claim 9 , wherein the one or more processors are further configured to take the action to display the risk score of the user.
15. The system of claim 9 , wherein the one or more processors are further configured to take the action to provide electronic training to the user.
16. The system of claim 9 , wherein the one or more processors are further configured to use the risk score of the user to establish a group risk score.