Systems and methods for monitoring security of an organization based on a normalized risk score

A method comprising:

• detecting, by a server, a plurality of risk indicators, at least one of the risk indicators identifying one of a plurality of activities of a network entity of an organization, the network entity comprising a device, an application or a user in the organization's network;
• generating, by the server, an overall risk score of the network entity, by:
• (a) generating respective risk scores, each respective risk score corresponding to a respective one of the plurality of risk indicators and generated according to:
• (i) a risk value of one or more of the activities of the network entity, (ii) an amplification factor and (iii) a dampening factor, of a respective one of the plurality of risk indicators,
• (b) performing a summation of the respective risk scores;
• and
• (c) adding an adjustment value to the summation of the respective risk scores;
• determining, by the server by scaling the overall risk score of the network entity with respect to a value, a normalized risk score of the network entity which indicates potential risk from the network entity to the organization;
• and
• initiating, by the server, an action according to the normalized risk score to protect the organization from the potential risk indicated by the normalized risk score of the network entity.

A non-transitory computer readable medium storing program instructions for causing one or more processors to:

• detect a plurality of risk indicators, at least one of the risk indicators identifying one of a plurality of activities of a network entity of an organization, the network entity comprising a device, an application or a user in the organization's network;
• generate, an overall risk score of the network entity, by:
• (a) generating respective risk scores, each respective risk score corresponding to a respective one of the plurality of risk indicators and generated according to:
• (i) a risk value of one or more of the activities of the network entity, (ii) an amplification factor and (iii) a dampening factor, of a respective one of the plurality of risk indicators,
• (b) performing a summation of the respective risk scores;
• and
• (c) adding an adjustment value to the summation of the respective risk scores;
• determine, by scaling the overall risk score of the network entity with respect to a value, a normalized risk score of the network entity which indicates potential risk from the network entity to the organization;
• and
• initiate an action according to the normalized risk score, to protect the organization from the potential risk indicated by the normalized risk score of the network entity.