Insider Risk Scoring
The signals that matter, scored, before they become an incident.
Data-loss events, tamper attempts and after-hours access rarely mean much on their own. Work360 combines them into a single 0–100 risk score per person, recalculated nightly, so the handful of people worth a conversation surface on their own.
Most monitoring tools give you a log and leave the judgement to you: which means the signal is there, in a table nobody reads, until the week it matters. Insider risk turns those same events into a ranked list: who moved, why their score moved, and what the underlying events were.
Scores are built from evidence you can open. Every contribution is traceable back to the DLP event, the tamper alert or the out-of-hours session that produced it, so a conversation with an employee starts from a fact rather than a feeling.
Everything included
6 capabilities, out of the box, with no add-ons, no extra licences.
One score per person
DLP events, agent tamper attempts and after-hours access combine into a single 0–100 score, recalculated nightly.
Ranked, not listed
The dashboard leads with movement: who rose this week: instead of an undifferentiated event feed.
Traceable to evidence
Every score opens into the events behind it. Nothing is a black box you have to take on trust.
Nightly alerting
A scheduled pass raises an alert when someone crosses the threshold, so you are not relying on anyone remembering to look.
Scoped to what you monitor
Risk only reflects the signals you have chosen to collect: turn a source off and it stops contributing.
Built for a conversation
Designed to start a fair discussion, not to produce a verdict. The employee sees the same collection settings on their own privacy page.
Related features
Ready to see insider risk scoring in action?
Start a free trial and put Work360 to work across your team in minutes. No credit card to start.