Insider Risk Index Scoring Methodology
Complete transparency of our insider risk assessment framework including scoring methodology, research sources, and the scientific foundation behind our 5-pillar evaluation system.
How is the Insider Risk Index scored? The assessment scores 20 questions across 5 weighted pillars — Visibility (25%), Prevention & Coaching (25%), Investigation & Evidence (20%), Identity & SaaS (15%), and Phishing Resilience (15%). Each answer maps to a 0–100 value; each pillar subscore is the normalized weighted average of its questions; and the final IRI is the sum of pillar score × pillar weight, banded into 5 maturity levels from Ad Hoc to Optimized. See the worked example below.
Five-Pillar Scoring Framework
Our assessment evaluates organizational maturity across five research-validated pillars, each weighted based on economic impact and incident frequency data from authoritative sources.
Visibility & Monitoring
Comprehensive monitoring and detection of insider activities across your organization
Research Rationale
Gartner's 'Rule of Three' framework identifies visibility as the foundation for detecting the three threat types (careless users, malicious users, compromised credentials). 85% of effective programs utilize User Behavior Analytics (UBA).
Prevention & Coaching
Proactive measures and training to prevent insider threats before they occur
Research Rationale
Since more than 50% of insider incidents lack malicious intent, prevention programs are essential. Organizations with comprehensive prevention reduce incident costs by 31% and experience 27% fewer insider threat events.
Investigation & Evidence
Robust capabilities for investigating incidents and preserving digital evidence
Research Rationale
Organizations with mature investigation capabilities reduce average containment time from 67 days to 52 days, saving an average of $2.1M per incident.
Identity & SaaS Management
Strong identity management and secure access controls for cloud applications
Research Rationale
Gartner's 2024 research shows that 92% of insider incidents involve identity-related vulnerabilities, making robust IAM controls essential.
Phishing Resilience
Advanced protection against phishing attacks and social engineering
Research Rationale
Verizon's 2026 DBIR identifies phishing as the enabler for 62% of breaches with human elements, making comprehensive phishing resilience critical.
Scoring Methodology & Calculation
Transparent documentation of how scores are calculated, normalized, and benchmarked
Assessment Structure
Calculation Formula:
IRI = Σ(pillar_score × pillar_weight) for all 5 pillarsMaturity Levels
Worked Example: 20 Answers to a Final Score
A step-by-step walkthrough of how a completed assessment becomes an Insider Risk Index score and a maturity band.
Step 1 — Answer 20 questions (four per pillar)
Each question is answered on a 0–100 scale. For a pillar with equally weighted questions, the pillar subscore is simply the average of its four answers. Different question types are handled by their weight: a graded/maturity question can carry more weight than a binary one, and the subscore is the weighted average normalized to 0–100. Unanswered questions are excluded from the denominator, so a partial assessment still scores on what was answered.
Step 2 — Compute each pillar subscore
| Pillar | Sample answers (0–100) | Subscore | Weight | Contribution |
|---|---|---|---|---|
| Visibility | 75, 50, 100, 75 | 75.0 | 25% | 18.75 |
| Prevention & Coaching | 50, 50, 75, 25 | 50.0 | 25% | 12.50 |
| Investigation & Evidence | 25, 50, 50, 75 | 50.0 | 20% | 10.00 |
| Identity & SaaS | 75, 100, 50, 75 | 75.0 | 15% | 11.25 |
| Phishing Resilience | 50, 25, 50, 75 | 50.0 | 15% | 7.50 |
Step 3 — Weight, sum, and band
Multiply each subscore by its pillar weight (the Contribution column), then add the five contributions to get the Insider Risk Index:
IRI = 18.75 + 12.50 + 10.00 + 11.25 + 7.50 = 60.0A score of 60.0 falls in the 45–64 range, placing this organization at Level 3 — Managed: a structured program with some automation, with its clearest gaps in Prevention & Coaching and Phishing Resilience.
Why this example matters: the two 50-scoring pillars pull the score down more when they carry higher weight. That is why the fastest way to raise an IRI is usually to improve the weakest high-weight pillar first — here, Prevention & Coaching at 25%.
Research Sources & Citations
Our methodology is built on authoritative research from leading cybersecurity organizations
Ponemon Institute 2026 Global Cost of Insider Threats Report
Key Findings Used
- Average annual cost: $19.5M (up from $17.4M)
- Average cost per incident: $676,517
- Average containment time: 67 days
- Average incidents per organization: 13.5 annually
Citation
Ponemon Institute LLC. (2025). 2025 Global Cost of Insider Threats Report. Traverse City, MI: Ponemon Institute.
Gartner Market Guide for Insider Risk Management Solutions
Key Findings Used
- 48% increase in insider attacks reported
- 71% of organizations feel vulnerable to insider threats
- 70% identify technical challenges as implementation obstacles
- 92% of insider incidents involve identity vulnerabilities
Citation
Predovich, B., & Gopal, D. (2024). Market Guide for Insider Risk Management Solutions (Document ID: G00805757). Stamford, CT: Gartner, Inc.
Verizon 2026 Data Breach Investigations Report
Key Findings Used
- 62% of breaches included non-malicious human element
- 70% of healthcare breaches were internal
- 28% of breaches driven by human errors
- 40% of social engineering attacks were BEC/CEO fraud
Citation
Verizon Enterprise. (2024). 2024 Data Breach Investigations Report (17th Edition). New York, NY: Verizon Communications Inc.
Forscie® Insider Threat Matrix™
Key Findings Used
- 50+ documented insider threat techniques
- Categorized by motive, coercion, and manipulation
- Prevention and detection strategies mapped
- Real-world attack pattern documentation
Citation
Forscie® Limited. (2024). Insider Threat Matrix™. Retrieved from https://insiderthreatmatrix.org/. Copyright 2026 Forscie® Limited.
Benchmark Data Sources
How we derive industry and organizational benchmarks for comparative analysis
Industry Benchmarks
Based on Ponemon Institute industry-specific cost data
Size-based Benchmarks
Organizational maturity by company size
Methodology Version History
Transparent documentation of methodology evolution and improvements
Version 2.2
Released: July 2026
Updates: Added a step-by-step scoring worked example (20 answers to a final IRI), an answer-first scoring summary, and stacked Article/HowTo/FAQ structured data for methodology transparency.
- • Published the exact pillar-weighting and normalization math with a worked example
- • Documented how binary vs. graded questions are weighted and how blanks are handled
- • Added HowTo + FAQ schema targeting “how does the IRI score my controls”
Version 2.1
Released: September 2025
Updates: Added industry-specific benchmarking, enhanced regional compliance framework, integrated Forscie® Insider Threat Matrix™ threat intelligence
- • Added Manufacturing, Government, Education, and Retail sector analysis
- • Integrated GDPR, CCPA, PIPEDA compliance considerations
- • Enhanced Matrix technique mapping with 50+ documented patterns
- • Updated research citations with 2025 Ponemon data
Version 2.0
Released: June 2025
Updates: Initial comprehensive framework with 5-pillar methodology
- • Established weighted scoring system (25%, 25%, 20%, 15%, 15%)
- • Integrated Ponemon Institute 2026 and Verizon DBIR 2026 data
- • Added Gartner Market Guide framework alignment
- • Implemented 5-level maturity model
Experience Our Transparent Methodology
Take our research-backed assessment and see how your organization measures against industry benchmarks using our scientifically-validated framework.