One number for how exposed you are to your own people.
Twenty questions, five weighted pillars, a score out of 100 benchmarked against your industry and company size. Free, no account, about eight minutes.
No registration. Results on screen immediately. Board-ready PDF if you want one.
The scale
Score 47 out of 100, level 3 of 5, Managed.
47 is the running average across 1,247 assessments. Your score is placed on this scale and against peers of your industry and size.
- Average annual cost of insider risk per organization
- $19.5MAverage annual cost of insider risk per organizationPonemon / DTEX, Cost of Insider Risks 2026
- Average time to contain a single incident
- 67 daysAverage time to contain a single incidentPonemon / DTEX 2026, down from 86 in 2023
- Of breaches that involve a human element
- 62%Of breaches that involve a human elementVerizon DBIR 2026
Five pillars, weighted by how much they move the outcome
The weights come from incident data, not opinion. A program usually fails because one pillar is near zero, which is why the score shows the breakdown and not just the total.
Visibility
Whether you would see it happen at all.
25%Prevention & Coaching
Whether people are steered away from the risky path before they take it.
25%Investigation & Evidence
Whether an incident resolves into something you can act on.
20%Identity & SaaS/OAuth
Whether access matches the person, still, today.
15%Phishing Resilience
Whether a convincing message turns one person into an entry point.
15%
What each band actually means
The level matters more than the number. Moving one band is a year of work, and the report tells you which pillar buys that move most cheaply.
- 0–24
Ad Hoc
No program to speak of. Incidents are discovered by accident.
- 25–44
Emerging
Controls exist in pockets. Nothing is consistent across teams.
- 45–64
Managed
The program runs, but evidence is thin and response is manual.
- 65–84
Proactive
Behavior is baselined, investigations hold up, response is fast.
- 85–100
Optimized
Measured, rehearsed, and improving. Insider risk is a managed line item.
Recent research
Published analysis of how insider risk is actually changing, with sources you can check.
Above vs Microsoft Purview for Insider Risk (2026): Where E5 Coverage Ends
Above vs Microsoft Purview Insider Risk Management in 2026. What E5 already gives you, where Purview's coverage stops, and when a dedicated platform is worth the second licence.
Above vs Proofpoint ITM for Insider Risk (2026): Session Recording vs Intent Investigation
Above vs Proofpoint Insider Threat Management (ObserveIT) in 2026. Where session recording still wins, where it does not, and how to choose without buying a second email security suite.
What Is Insider Risk Management? The 2026 Definition, and How It Differs From DLP, UEBA and ITM
A plain definition of insider risk management, how it differs from DLP, UEBA and insider threat management, the four types of insider, and why most programmes fail for reasons that are not technical.
No vendor writes this index
The assessment is free and takes no account. No vendor pays to appear in the comparisons or sees one before it publishes, and the scoring criteria are published so you can disagree with them.
- Questions
- 20, each mapped to a published research source
- Pillars
- 5, weighted from incident outcome data
- Benchmarks
- By industry and company size, recomputed as responses arrive
- Technique mapping
- Forscie Insider Threat Matrix, Apache 2.0
- Cost
- Free, no account required
Find your number
Eight minutes, twenty questions, and a result you can put in front of a board without defending the source.