Permiso Security announced the Permiso Risk Score Engine, a proprietary model that assigns continuous, multi-dimensional risk scores to every identity in an organization’s environment. The Risk Score Engine is powered by Permiso’s Universal Identity Graph and produces three distinct scoring outputs: Identity Risk Scores that prioritize which identities carry the most risk, Session Scores that highlight which activity needs immediate investigation, and Organization Risk Scores that roll up identity risk into a single tenant-level, quantifiable metric with peer benchmarking.
“Before Permiso, we had no way to quantify identity risk across our environment in a single view. The Risk Score Engine changed that. We can now see exactly which identities carry the most risk, why, and how that risk is trending over time. It has fundamentally improved how we prioritize.”
– Brian Salomon, Security Engineer, YAGEO Group
Enterprise security teams today are unable to answer a straightforward question: across every environment, what is my overall identity risk, and what specifically are the biggest contributing factors? Answering it requires comprehensive visibility of every identity type and runtime behavioral data showing what each identity is doing at any given minute. Most organizations have neither. They assign identities a fixed risk tier based on privilege level and leave it there, or rely on noisy alert-driven approaches that only flag an identity when a detection fires. Neither scales.
The Permiso Risk Score Engine addresses these issues through a blend of static posture, graphed relationships between identities, and runtime data to score every identity on a 0-to-100 scale across three dimensions: Behavior (is this identity doing something unusual), Likelihood (is this identity likely compromised), and Impact (how much damage can this identity cause). The three-dimensional approach ensures that two identities with the same composite score, but different risk profiles, receive distinct response recommendations, giving security teams actionable intelligence rather than a single number.
“The identity security market has lacked a consistent, quantifiable way to measure risk across all identity types. Continuous scoring that combines posture, behavior, and context into a single model is where the industry needs to go, and it is a meaningful step beyond what legacy ITDR and ISPM tools offer today.”
– Chris Kissel, Research Vice President, Security Products at IDC
Key Capabilities
• Three-dimensional scoring (Behavior, Likelihood, Impact) that explains why an identity is risky and prescribes specific responses based on the risk profile.
• Dual-layer risk computation combining static posture analysis (privilege levels, credential hygiene, entitlement scope) with runtime behavioral signals (active anomalies, threat intelligence matches, authentication context).
• Session-level scoring on dual axes (Suspicion and Impact) that enables SOC teams to triage active sessions based on what is happening now, independent of the identity’s historical risk profile.
• Score velocity detection that identifies when the rate of score change is itself the signal, catching identity compromise sequences that unfold over minutes rather than days.
• Organization-level risk posture with peer benchmarking that gives CISOs a trackable, reportable metric for board-level communication on identity risk.
• Coverage across every identity type, from human users to service accounts, API keys, OAuth tokens, and IAM roles, including AI agents, the fastest-growing and least-governed identity class, scored with the same model as every other identity.
“Static labels and one-alert-at-a-time triage do not scale when you are managing a global employee base, sprawling NHIs, and a growing agentic workforce. The Risk Score Engine gives every identity a continuous, evidence-backed score that tells you not just that something is risky, but why, and what to do about it.”
– Paul Nguyen, Co-Founder and CEO, Permiso Security
Availability
The Permiso Risk Score Engine is available now as part of the Permiso platform.
