human-risk-scoring

# Human Risk Scoring ## Overview A human risk score turns training-completion and phishing-simulation signal into one comparable number per user (and rolled up per org), so an MSP can prioritize remedial attention the same way `tenant-exposure-ranker` in secops-pack prioritizes technical exposure. The design goal here is the same discipline that pack applies: an explainable ranked comparison with visible inputs, never an opaque score a reviewer has to take on faith. ## Anti-triggers - **A vendor's own user risk score** — KnowBe4 and Proofpoint each compute one from their own data alone; use `knowbe4-reporting` or `proofpoint-people`. This skill blends inputs across tools and keeps the factor table visible. - **Technical exposure ranking** — ranking tenants or endpoints by threat and configuration posture is a different axis from human risk; use `alert-severity-normalization` in secops-pack. ## Step Zero: Confirm What's Connected Call `conduit__search_tools` to determine which inputs are actually available before scoring anything. This skill's inputs, from strongest to weakest available data: 1. **Training completion** (from `training-completion-tracking`) — whether the user is current on required training, and how overdue they are if not. 2. **Phishing-simulation performance** (from `phishing-simulation-analysis`) — click/fail history and repeat-clicker status. 3. **Real-world click-through data** (optional) — from a connected email-security tool (Pr...