Human Risk Signals

A human risk signal is a reusable indicator derived from security activity. It describes an observed pattern for a person, such as an account lockout, a reported phishing message, or a completed security task. Living Security uses signals to turn records from different security tools into a consistent form. Teams can then use the same signal in analysis, scorecards, and risk-reduction workflows.

​

How a signal works

A signal definition combines a few clear parts: For example, a signal can count reported phishing messages over a rolling period. Another signal can measure the share of assigned training that a person completed.

​

Signal posture

Posture states what a signal means. It does not describe the importance of a person.

​

System and custom signals

• System signals are maintained by Living Security. They provide common definitions for supported activity.
• Custom signals let a customer define an organization-specific indicator from its own activity data.

Not every signal contributes to every score. A scorecard or model selects the signals that are relevant to its purpose.

​

Where signal data comes from

Signals can use activity from connected identity, email security, security awareness, endpoint, cloud, and other systems. Living Security maps provider records to a shared activity vocabulary before signal evaluation. A signal can exist before a built-in integration supplies it. This dormant state lets the definition start working when a future integration or Custom Push Source sends matching activity. Learn more in Signal data sources.

​

Shared human risk terminology

Living Security uses stable terms for observed behaviors where they have been reviewed. The vendor-neutral Human Risk Management Framework provides a broader vocabulary for human cyber risk. Product signals and framework indicators are separate records. A term can align without creating a one-to-one mapping, and the independent framework does not endorse a vendor or product.

​

Explore next