> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-card/user-risk.md).

# User risk

The user risk includes a breakdown of all risk elements that contribute to the user's risk score, as well as the risk score trend over the last 30 days. This data is refreshed every 12 hours. User risk comprises:

* [Risk elements](#risk-elements)
* [Benchmarking](#benchmarking)
* [Risk score trend](#risk-score-trend)

{% hint style="info" %}
The effect that each risk element has on the user's total risk score is indicated in the **Impact** column: from low to critical, or no impact whatsoever.
{% endhint %}

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FFPhdFuj9Z9BXctGNqBqi%2Fidentity%20risk.png?alt=media&amp;token=f1f06038-1a48-4f77-bdb5-adf895e8e785" alt="" width="563"><figcaption><p>User risk is based on a set of risk elements</p></figcaption></figure></div>

## Risk elements

User risk includes these risk elements:

<table><thead><tr><th width="203">Risk element</th><th>Description</th></tr></thead><tbody><tr><td>Exposure level</td><td>Breakdown of the user's attack surface according to the number of Google and Slack assets the user shared: Internal, external, public</td></tr><tr><td>DLP exposure</td><td>Exposure level for user's Google and Slack assets with highly sensitive names. <br>With benchmarking, the number of sensitive assets the user shared is compared to the number of sensitive assets the average department user shared.</td></tr><tr><td>VIP</td><td>An indication whether this user is a VIP, with the specific VIP role </td></tr><tr><td>Admin</td><td><ul><li>Number of integrated SaaS apps for which the user is an admin </li><li>Click the number to see the number of admin roles per app</li></ul></td></tr><tr><td>Latest alerts</td><td>Number of all active or archived alerts triggered by this user in the last 30 days</td></tr><tr><td>Latest workflows</td><td>Number of workflows triggered by this user in the last 30 days</td></tr><tr><td>Risky shadow apps</td><td><ul><li>Number of risky shadow apps currently installed by this user</li><li>Click the number to view all shadow apps currently installed by this user</li></ul></td></tr><tr><td>Employment status</td><td>User's employment status as updated in Okta or HRIS:  Active, About to leave, Terminated</td></tr><tr><td>Employment type</td><td><p>User's employment type as updated in Okta or an HR app:</p><ul><li>Full-time/ advisor </li><li>Part-time/ Intern/ Hourly </li><li>Contractor/ Outsourcer/ Contingent/ Temporary/ Freelancer </li></ul></td></tr></tbody></table>

{% hint style="info" %}
To understand the contribution of each risk element to the user's total risk score, see [Risk score logic](/docontrol-user-guide/risk-management/identities/risk-score-logic.md).
{% endhint %}

## Benchmarking

For most risk elements, DoControl compares the user's behavior to the average user in the **department**. The department behavior is used as a baseline when considering the contribution of each risk element to the total risk score.

If the department is small, DoControl compares the user to the average user in the **organization**.&#x20;

{% hint style="info" %}
These risk elements do not support benchmarking since they include non-comparable data:

* VIP and Admin roles
* Employment status
* Employment type
  {% endhint %}

Benchmarking between the user and department/organization is represented with a bar chart for each risk element:

<table><thead><tr><th width="228">Benchmark graph</th><th>Description</th></tr></thead><tbody><tr><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fd5IiLh3UMIrWjpLqAisH%2FBM%20user%20less.png?alt=media&amp;token=7f35cfa5-7c63-4ff4-bfd0-43b12969b7e7" alt=""></td><td>User's risky behavior is <strong>less</strong> than the behavior of the average department or organization user. This <strong>decreases</strong> the impact of the risk element.</td></tr><tr><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F2czeX2H79RM3bCGHFfRZ%2FBM%20user%20more.png?alt=media&amp;token=23252445-a2d0-4f23-960d-aa92b3fd8b84" alt=""></td><td>User's risky behavior is <strong>more</strong> than the behavior of the average department or organization user. This <strong>increases</strong> the impact of the risk element.</td></tr><tr><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FE9gKTwQvNH5iSD7vhCWb%2FBM%20zero.png?alt=media&amp;token=681488b6-653c-4dba-965d-21aac2a8bfb3" alt=""></td><td>Both user and department have no behavior for this risk element</td></tr><tr><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FcEmkrQctEHGy063N2yqQ%2FBM%20user%20same%20dept.png?alt=media&amp;token=d9a43c60-c338-42aa-a8ff-def1cb6580a5" alt=""></td><td>User's risky behavior is the <strong>same</strong> as the behavior of the average department or organization user. This has <strong>no</strong> effect on the impact of the risk element.</td></tr></tbody></table>

{% hint style="success" %}
Click any benchmark graph to see it fully explained. For example: this user triggered more workflows than the average department user.
{% endhint %}

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FAx94dZVoPfVRgdEWFGCw%2FWF%20benchmarking.png?alt=media&amp;token=b769adfb-2476-4695-a346-2000654c5b9f" alt="" width="448"><figcaption><p>Each risk element is benchmarked against the average department user</p></figcaption></figure></div>

## Risk score trend

In a single view, see all the changes in the **user's risk score** compared to the average **department user's risk score** and average **organization user's risk score** over the last 30 days.

<table><thead><tr><th width="154">Entity icon</th><th>Entity</th></tr></thead><tbody><tr><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FiKWqm0tcCDa8FGo7yF4p%2Flow%20risk.png?alt=media&amp;token=2e0bd295-06e1-40bc-9281-8bc6a6360be6" alt=""></td><td>User's risk trend</td></tr><tr><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F643cviGKJBg02c5DPHYE%2Fmedium%20risk.png?alt=media&amp;token=3510b52c-8ff2-4000-a550-c6dd670768bf" alt=""></td><td>Average department user's risk trend</td></tr><tr><td><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F2lZZIc0eRJEL2U1yotER%2Fhigh.png?alt=media&amp;token=215e58d6-2d38-4385-8417-8c7f07240697" alt=""></td><td>Average organization user's risk trend</td></tr></tbody></table>

To see the risk snapshot for a user on a specific day, hover over the relevant graph:

* The **user's total risk score** is indicated if it increased or decreased compared to the previous day
* Each **risk element** is indicated if it increased or decreased compared to the previous day

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FbZsXODARh7PolJ0Iu3C3%2Fuser%20risk%20trend.png?alt=media&amp;token=2dcf5505-a492-47ec-b315-75560afae808" alt=""><figcaption><p>See risk snapshots for any user on any day in the last month</p></figcaption></figure>

{% hint style="info" %}
For the user above:

* On May 20, his/her total risk score is **68**, which increased in comparison to the day before.
* Since the previous day, this user's exposure level and DLP exposure **increased**.
* Since the previous day, the number of risky shadow apps installed by this user **decreased**.
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/identities/identity-card/user-risk.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.