SYSTEMS AND METHOD FOR GENERATING RISK SCORES

1 . A method for generating a risk score of a user based at least on groups of events related to security, the method comprising:

receiving, by one or more servers, data associated with a plurality of events over time, the plurality of events representing one or more security risks associated with one or more users to an organization;

identifying, by the one or more servers, a plurality of buckets for which to assign the plurality of events, each bucket identifying a collection of events that are assigned a level of risk from a plurality of levels of risk, each level of risk assigned a weight;

assigning, by the one or more servers, each event of the plurality of events to a bucket of the plurality of buckets based at least on a type associated with each event;

computing, by the one or more servers, a risk score for a user of the one or more users based at least on a function of the weight assigned to each bucket and a quantity of events in each bucket; and

providing, by the one or more servers, a graphical user interface configured to display the risk score and information identifying reasons computation of the risk score changes over time for the user.

2 . The method of claim 1 , wherein the graphical user interface is further configured to display one or more recommendations for mitigations based on risk factors identified while generating the risk score.

3 . The method of claim 1 , further comprising determining, by the one or more servers, an action to take based at least on the risk score.

4 . The method of claim 3 , further comprising taking, by the one or more servers, the action of providing electronic training to the user corresponding to the risk score of the user or the action of initiating a simulated phishing campaign targeted to the user based at least on the risk score.

5 . The method of claim 1 , wherein each event comprises a type of a risky event, a secure event or a mitigation event.

6 . The method of claim 1 , further comprising assigning, by the one or more servers, each of the plurality of buckets to an aggregator bucket of a plurality of aggregator buckets; each aggregator bucket of the plurality of aggregator buckets comprising a collection of one or more buckets representing related elements of security risk.

7 . The method of claim 6 , wherein each aggregator bucket of the plurality of aggregator buckets is assigned second weight according to a second level of risk assigned to each aggregator bucket.

8 . The method of claim 6 , further comprising generating, by the one or more servers, the risk score for the user based on the function of the second weight assigned to each aggregator bucket.

9 . The method of claim 1 , further comprising removing, by the one or more servers, an event of the plurality events from a bucket based on meeting a threshold of a number of look back days.

10 . The method of claim 1 , further comprising modifying, by the one or more servers, the risk score based at least on one of a booster factor or an offset of the user or the organization.

11 . A system for generating a risk score of a user based at least on groups of events related to security, the system comprising:

one or more servers comprising one or more processors, coupled to memory and configured to:

receive a plurality of events over time related to security risk of one or more users to an organization;

identify, by a model, a plurality of buckets for which to assign the plurality of events, each bucket identifying a collection of events that are assigned a level of risk from a plurality of levels of risk, each level of risk assigned a weight;

assign, by the model, each event of the plurality of events into a bucket of the plurality of buckets based at least on a type of each event;

compute, by the model, a risk score for a user of the one or more users based at least on a function of the weight assigned to each bucket and a quantity of events in each bucket; and

cause a display of a graphical user interface configured to display the risk score and information identifying reasons computation of the risk score changes over time for the user.

12 . The system of claim 11 , wherein the graphical user interface is further configured to display one or more recommendations for mitigations based on risk factors identified while generating the risk score.

13 . The system of claim 11 wherein the one or more servers are further configured to determine an action to take based at least on the risk score.

14 . The system of claim 13 , wherein the one or more servers are further configured to take the action of providing electronic training to the user corresponding to the risk score of the user or the action of initiating a simulated phishing campaign targeted to the user based at least on the risk score.

15 . The system of claim 11 , wherein each event comprises a type of a risky event, a secure event or a mitigation event.

16 . The system of claim 11 , wherein the model is further configured to assign each of the plurality of buckets to an aggregator bucket of a plurality of aggregator buckets; each aggregator bucket of the plurality of aggregator buckets comprising a collection of one or more buckets representing related elements of security risk.

17 . The system of claim 16 , wherein each aggregator bucket of the plurality of aggregator buckets is assigned second weight according to a second level of risk assigned to each aggregator bucket.

18 . The system of claim 16 , wherein the model is further configured to compute the risk score for the user based on the function of the second weight assigned to each aggregator bucket.

19 . The system of claim 11 , wherein the one or more servers are further configured to remove an event of the plurality events from a bucket based on meeting a threshold of a number of look back days.

20 . The system of claim 11 , wherein the model is further configured to modify the risk score based at least on one of a booster factor or an offset of the user or the organization.