# US 11,310,261 B2 · Assessing security risks of users in a computing network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,261 B2 - Document ID: US11310261B2 - Status: Granted - Kind: B2 - Application number: 16/910,801 - Filed: 2020-06-24 - Published: 2021-01-21 - Granted: 2022-04-19 - Earliest claimed: 2011-04-08 - Assignees: Proofpoint, Inc. - Applicants: Proofpoint, Inc. - Inventors: Trevor Tyler Hawthorn; Norman Sadeh-Koniecpol; Nathan Miller; Jeff Losapio; Kurt Wescoe; Jason Brubaker; Jason Hong - Web page: https://patentgrep.com/patent/US11310261B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Various embodiments assess security risks of users in computing networks. In some embodiments, an interaction item is sent to an end user electronic device. When the end user interacts with the interaction item, the system collects feedback data that includes information about the user's interaction with the interaction item, as well as technical information about the electronic device. The feedback is compared to a plurality of security risk scoring metrics. Based on this comparison, a security risk score for the user with respect to a computing network. ## Claims ### Claim 1 A method, comprising: at a security system comprising at least one processor and memory: generating an interaction item, wherein the interaction item comprises one or more of a training item or a security item; transmitting the interaction item to an end user electronic device via a network; receiving feedback data from the end user electronic device, wherein the feedback data comprises sensed data relating to an action of a user of the end user electronic device associated with the interaction item, and wherein the feedback data comprises technical information associated with the end user electronic device; comparing the feedback data to a plurality of security risk scoring metrics; based on comparing the feedback data to the plurality of security risk scoring metrics, determining a security risk score, wherein the security risk score quantifies a cybersecurity risk presented by the user of the end user electronic device; generating a subsequent interaction item based on the security risk score, wherein the subsequent interaction item comprises one or more of a training item or a security item, and wherein the subsequent interaction item includes a number of fields, each field of the number of fields having an associated value; assigning a weight to each field of the number of fields based on the field's associated value; and determining a sophistication score for the subsequent interaction item by totaling the weights associated with each field of the number of fields. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of security risk scoring metrics comprise: a set of metrics assigning a weight to the action of the user of the end user electronic device associated with the interaction item, and a set of metrics assigning a weight to a technical attribute defined for the technical information associated with the end user electronic device. ### Claim 3 (depends on 2) The method of claim 2, wherein the technical information comprises one or more of a network address, a device make, a device model, a software version, an operating system version, firewall data, or a platform type. ### Claim 4 (depends on 1) The method of claim 1, wherein receiving the feedback data from the end user electronic device comprises receiving data sensed by a sensor of the end user electronic device. ### Claim 5 (depends on 1) The method of claim 1, wherein receiving the feedback data from the end user electronic device comprises receiving security item interaction data received at the end user electronic device via an input/output interface. ### Claim 6 (depends on 1) The method of claim 1, wherein receiving the feedback data from the end user electronic device comprises receiving training item interaction data received at the end user electronic device via an input/output interface, the training item interaction data comprising completion data. ### Claim 7 (depends on 1) The method of claim 1, comprising: adjusting a frequency of presenting one or more subsequent interaction items to the user of the end user electronic device based on the security risk score. ### Claim 8 (depends on 1) The method of claim 1, comprising: adjusting a sophistication score of one or more subsequent interaction items presented to the user of the end user electronic device based on the security risk score. ### Claim 9 (depends on 1) The method of claim 1, comprising: adjusting network security controls for the user of the end user electronic device based on the security risk score. ### Claim 10 (depends on 1) The method of claim 1, wherein generating the interaction item comprises generating one or more of a simulated security item, a simulated training item, an actual security item, or an actual training item. ### Claim 11 (depends on 1) The method of claim 1, comprising: causing the end user electronic device to present the subsequent interaction item to the user of the end user electronic device, wherein the subsequent interaction item instructs the user of the end user electronic device on how to interact with at least one security item; and recording an indication that the user of the end user electronic device interacted with the subsequent interaction item based on the subsequent interaction item being presented by the end user electronic device. ### Claim 12 (depends on 1) The method of claim 1, comprising: identifying one or more additional users to form a group of users; and calculating a collective security risk score for the group of users based on an individual risk score calculated for each user in the group of users. ### Claim 13 A security system, comprising: at least one processor; and memory storing instructions that, when executed by the at least one processor, cause the security system to: generate an interaction item, wherein the interaction item comprises one or more of a training item or a security item; transmit the interaction item to an end user electronic device via a network; receive feedback data from the end user electronic device, wherein the feedback data comprises sensed data relating to an action of a user of the end user electronic device associated with the interaction item, and wherein the feedback data comprises technical information associated with the end user electronic device; compare the feedback data to a plurality of security risk scoring metrics; based on comparing the feedback data to the plurality of security risk scoring metrics, determine a security risk score, wherein the security risk score quantifies a cybersecurity risk presented by the user of the end user electronic device; generate a subsequent interaction item based on the security risk score, wherein the subsequent interaction item comprises one or more of a training item or a security item, and wherein the subsequent interaction item includes a number of fields, each field of the number of fields having an associated value; assign a weight to each field of the number of fields based on the field's associated value; and determine a sophistication score for the subsequent interaction item by totaling the weights associated with each field of the number of fields. ### Claim 14 (depends on 13) The security system of claim 13, wherein the plurality of security risk scoring metrics comprise: a set of metrics assigning a weight to the action of the user of the end user electronic device associated with the interaction item, and a set of metrics assigning a weight to a technical attribute defined for the technical information associated with the end user electronic device. ### Claim 15 (depends on 14) The security system of claim 14, wherein the technical information comprises one or more of a network address, a device make, a device model, a software version, an operating system version, firewall data, or a platform type. ### Claim 16 (depends on 13) The security system of claim 13, wherein receiving the feedback data from the end user electronic device comprises receiving data sensed by a sensor of the end user electronic device. ### Claim 17 (depends on 13) The security system of claim 13, wherein receiving the feedback data from the end user electronic device comprises receiving security item interaction data received at the end user electronic device via an input/output interface. ### Claim 18 (depends on 13) The security system of claim 13, wherein receiving the feedback data from the end user electronic device comprises receiving training item interaction data received at the end user electronic device via an input/output interface, the training item interaction data comprising completion data. ### Claim 19 (depends on 13) The security system of claim 13, wherein the memory stores additional instructions that, when executed by the at least one processor, cause the security system to: adjust a frequency of presenting one or more subsequent interaction items to the user of the end user electronic device based on the security risk score. ### Claim 20 One or more non-transitory computer-readable media storing instructions that, when executed by a security system comprising at least one processor and memory, cause the security system to: generate an interaction item, wherein the interaction item comprises one or more of a training item or a security item; transmit the interaction item to an end user electronic device via a network; receive feedback data from the end user electronic device, wherein the feedback data comprises sensed data relating to an action of a user of the end user electronic device associated with the interaction item, and wherein the feedback data comprises technical information associated with the end user electronic device; compare the feedback data to a plurality of security risk scoring metrics; based on comparing the feedback data to the plurality of security risk scoring metrics, determine a security risk score, wherein the security risk score quantifies a cybersecurity risk presented by the user of the end user electronic device; generate a subsequent interaction item based on the security risk score, wherein the subsequent interaction item comprises one or more of a training item or a security item, and wherein the subsequent interaction item includes a number of fields, each field of the number of fields having an associated value; assign a weight to each field of the number of fields based on the field's associated value; and determine a sophistication score for the subsequent interaction item by totaling the weights associated with each field of the number of fields.