Your organisation's overall risk score provides a useful starting point, but there's more to the picture than a single number.
Encrisoft's Risk Breakdown gives you a closer look at how people with calculated risk scores are distributed across four risk levels: Low, Medium, High, and Critical. This helps you understand the spread of observed human cyber risk across your organisation rather than relying on the overall score alone.
Understanding the Risk Levels
The Risk Breakdown groups scored individuals into four categories:
- Low: Lower observed human cyber risk.
- Medium: Moderate observed human cyber risk.
- High: Elevated observed human cyber risk.
- Critical: Particularly elevated observed human cyber risk.
These categories help you see how risk is distributed among the people included in the assessment. They are indicators of observed behaviour, not predictions of future incidents or judgements about individual employees.
What Does Your Breakdown Tell You?
The distribution of risk across these categories can help you identify patterns worth paying attention to.
For instance, a concentration of people in the High or Critical categories may indicate an area where additional security awareness efforts deserve consideration. Meanwhile, understanding how risk is distributed across the organisation can help you make more informed decisions about where to focus your attention.
The breakdown is most useful when considered alongside other information available in Encrisoft, including simulation outcomes and training activity.
The goal is not simply to see where risk exists, but to understand where action may be worthwhile.
When No Breakdown Is Available
If your Risk Breakdown panel displays "No risk breakdown available," there is currently no breakdown to display.
This does not automatically mean your organisation has no human cyber risk. The information available depends on recorded activity and whether sufficient data exists to produce a breakdown.
As more relevant information becomes available, the Risk page can offer a clearer picture of your organisation's observed risk.
Turning Risk Insights into Action
Understanding your breakdown is a starting point for making better-informed security decisions.
Use the information to identify areas that may benefit from additional awareness training, review relevant simulation outcomes, and monitor whether observed behaviour improves over time.
Remember that risk indicators support decision-making; they do not replace professional security judgement or guarantee that your organisation is protected against every threat.
Understand your risk. Recognise the patterns. Take informed action.