People become sensors
When most staff report suspicious messages, an attack is spotted in minutes, often before anyone clicks.
Median first report: 6 minutesSecurity training · Human risk
See your human risk. Then shrink it.
One score, built from what people know, how they behave under attack and how much access they hold, for every person, team and attack type. Watch a year of a real program play out on the right.
What goes into the score
Explainable, not a black box
Six inputs, each weighted and shown. Move them for one person and watch the score and the recommended action change.
Resilience by attack type
Know which attacks your company can withstand
For each attack type: the share of people who fell for it, and the share who reported it. Switch between the first and the latest quarter.
Why resilience matters
How a resilient workforce strengthens security
Every point of resilience shows up somewhere else in your program. CompliLens connects the chain, so you can see it.
Fewer stolen credentials
Lower click rates on credential lures mean fewer accounts to reset and fewer sessions to revoke.
Credential incidents: downFaster containment
Reports open incidents with clocks running, so containment and regulator notification start sooner.
Reported in time: every incidentLower residual risk
Phishing and fraud risks are rescored as resilience improves, so the risk register reflects reality.
RSK-031: 15 → 4TrainingClick rate fallsReports riseFewer incidentsResidual risk fallsObjectives metManagement review
Team view
Where to focus next, team by team
| Team | Score | Band | Weakest against | Automatic next step |
|---|---|---|---|---|
| Engineering | 14 | Low | Smishing | Two-minute SMS lesson |
| Sales | 31 | Moderate | QR-code phishing | QR simulation in 2 weeks |
| Finance | 22 | Low | Deepfake voice | Voice-clone drill booked |
| Operations | 43 | High | Credential phishing | Track re-assigned, manager notified |
| Support | 35 | Moderate | Vishing | Phone verification refresher |
| Leadership | 27 | Moderate | Business email compromise | Executive briefing scheduled |
Automations
When risk moves, the program responds
Someone fails a simulation
ThenAssign a short lesson on the exact red flags they missed.
Someone fails two in a row
ThenNotify their manager privately and schedule a follow-up simulation.
A team's score rises above 40
ThenRaise a task for the security lead and add it to the next management review.
A competency falls below 60
ThenSchedule a refresher for everyone in that team.
A person reports a real phish
ThenOpen an incident, thank the reporter and pull matching messages.
A new admin is appointed
ThenAssign privileged-access training before access is granted.
Privacy and fairness
Coaching, not surveillance
Human risk scores exist to help people, not to rank them. Employees see their own progress and next steps. Individual scores are visible only to administrators you choose, and every view of them is logged.
- Role-based visibility for individual scores
- No public leaderboards of mistakes
- Reporting earns credit, even after a click
- Scores decay as people improve, so the past is not held against them
Human risk fell 66% this yearOn track
Score64 → 22
Click rate31% → 4%
Report rate9% → 71%
Training94%
Exported as a PDF and added to the management review snapshot automatically.
Keep exploring