> ## Documentation Index > Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Human Risk Signals > Learn how human risk signals turn security activity into consistent indicators for analysis, scoring, and action. A **human risk signal** is a reusable indicator derived from security activity. It describes an observed pattern for a person, such as an account lockout, a reported phishing message, or a completed security task. Living Security uses signals to turn records from different security tools into a consistent form. Teams can then use the same signal in analysis, scorecards, and risk-reduction workflows. ## How a signal works A signal definition combines a few clear parts: | Part | Purpose | | -------------------- | ------------------------------------------------------------ | | **Activity** | The event or events to observe | | **Participant role** | The person who acted, received the action, or observed it | | **Time window** | The rolling period used to evaluate activity | | **Measure** | A count or proportion of matching activity | | **Posture** | The meaning of the observation: Risk, Protective, or Neutral | For example, a signal can count reported phishing messages over a rolling period. Another signal can measure the share of assigned training that a person completed. ## Signal posture Posture states what a signal means. It does not describe the importance of a person. | Posture | Meaning | | -------------- | --------------------------------------------------------------------------- | | **Risk** | The observed pattern can increase human cyber risk. | | **Protective** | The observed pattern can reduce risk or strengthen detection and response. | | **Neutral** | The pattern is useful context but does not have an assigned risk direction. | ## System and custom signals * **System signals** are maintained by Living Security. They provide common definitions for supported activity. * **Custom signals** let a customer define an organization-specific indicator from its own activity data. Not every signal contributes to every score. A scorecard or model selects the signals that are relevant to its purpose. ## Where signal data comes from Signals can use activity from connected identity, email security, security awareness, endpoint, cloud, and other systems. Living Security maps provider records to a shared activity vocabulary before signal evaluation. A signal can exist before a built-in integration supplies it. This dormant state lets the definition start working when a future integration or [Custom Push Source](/integrations/managing/setup#custom-push-sources) sends matching activity. Learn more in [Signal data sources](/signals/data-sources). ## Shared human risk terminology Living Security uses stable terms for observed behaviors where they have been reviewed. The vendor-neutral [Human Risk Management Framework](https://humanriskmanagement.com/) provides a broader vocabulary for human cyber risk. Product signals and framework indicators are separate records. A term can align without creating a one-to-one mapping, and the independent framework does not endorse a vendor or product. ## Explore next Learn how integrations can supply activity for signals. See how Living Security connects security and workforce systems. Learn how the Human Risk Index summarizes human cyber risk. See how the platform connects data, intelligence, and action.