human-risk-scoring

# Human Risk Scoring ## Overview A human risk score turns training-completion and phishing-simulation signal into one comparable number per user (and rolled up per org), so an MSP can prioritize remedial attention the same way `tenant-exposure-ranker` in secops-pack prioritizes technical exposure. The design goal here is the same discipline that pack applies: an explainable ranked comparison with visible inputs, never an opaque score a reviewer has to take on faith. ## Step Zero: Confirm What's Connected Call `conduit__search_tools` to determine which inputs are actually available before scoring anything. This skill's inputs, from strongest to weakest available data: 1. **Training completion** (from `training-completion-tracking`) — whether the user is current on required training, and how overdue they are if not. 2. **Phishing-simulation performance** (from `phishing-simulation-analysis`) — click/fail history and repeat-clicker status. 3. **Real-world click-through data** (optional) — from a connected email-security tool (Proofpoint, Avanan) exposing actual click or attack-targeting signal, where available. Not every input will be available for every client. Score with whatever subset is connected, and always state explicitly which inputs were used for a given score — a score computed from training data alone is a different, less complete signal than one that also incorporates simulation and real-click data, and the output must make that difference visible ...