How to measure human risk without turning the score into a disciplinary weapon

Measuring human risk has almost no positioned competition in this query. That is why this conversation links to the product pillar: the individual, team and company risk score.

A score to prioritize, not to punish

A score is used to prioritize interventions. Not to build a punitive ranking. The Trust Center and the contract have to say it plainly: no individual metric is used for disciplinary purposes by Whalemate. That is also in the DPA.

If the board only receives completion rate, it is not measuring risk. It is measuring attendance. The difference is the program.

The risk score term is the short definition. This note exists for "how to measure human cyber risk" and to keep the index from becoming a People weapon.

What goes into the index (and what does not)

The risk score consolidates signals from simulations, courses, reports and behavior into a number that can be tracked over time. We do not publish the formula in marketing: the detail lives in the product and in implementation, not in a headline.

Alongside the overall score, PAS combines simulation results and report rate to isolate the phishing-related part. Report rate is the active defensive gesture — the button in Outlook or Gmail — not attendance at a video.

What does not go in: an invented country ranking, a hall of shame, an industry average without a published report. If a number is not in a case study or a validated PDF, it is not a Whalemate figure.

Where it is operated

The product brief is human risk analytics. The awareness agent consumes those signals to decide the next intervention. Simulations and training feed the index; not the other way around: a campaign is not designed to inflate a chart.

PCI DSS 12.6 and ISO/IEC 27001 ask for program evidence. A well-governed score is input for board and auditor. A poorly governed score is a personnel file. Whalemate declares the first side.