Introducing the Risk Score Engine: identity risk you can quantify

Permiso has released the Risk Score Engine, a system designed to quantify identity risk across an organization using a scale from 0 to 100. The engine integrates static posture data with live behavioral signals from a Universal Identity Graph, covering human users, non-human identities, and AI agents. Risk is measured across three dimensions: Behavior (anomalies), Likelihood (compromise probability), and Impact (potential blast radius).
The system introduces "score velocity" to track the speed of risk changes and "session scores" to detect immediate threats regardless of an identity's historical baseline. Additionally, an Organization Risk Score provides a high-level metric benchmarked against other customers for executive reporting. The objective is to move beyond fragmented tooling—such as IGA, CIEM, and ISPM—which the provider claims creates "false confidence" by ignoring runtime activity or omitting specific identity types.

* Permiso launched the Risk Score Engine.
* The engine assigns identity risk scores from 0 to 100.
* Scores are categorized by Behavior, Likelihood, and Impact.
* The system utilizes a Universal Identity Graph.
* Covered identities include humans, non-humans, and AI agents.
* The engine produces Identity Risk Scores, Session Scores, and Organization Risk Scores.
* Score velocity tracks the rate of change in a risk score.
* The system utilizes over 1,500 detection signals from P0 Labs.
* Organization Risk Scores are benchmarked against a customer base.
* The Risk Score Engine is currently available as part of the Permiso platform.

The strongest version of this narrative is that modern enterprise environments have outpaced their security tools. By unifying disparate identity types—especially the surge in non-human and AI identities—into a single graph with runtime behavioral analysis, organizations can prioritize threats based on actual activity rather than theoretical permissions.
However, this is a classic vendor advertorial. The persuasion vector relies on creating a gap between the reader's current "fragmented" state and a promised "unified" state. It utilizes a Fear Appeal by framing existing security postures as "false confidence" and "a breach in progress," while simultaneously employing an Authority Game by citing its own internal research (P0 Labs) and proprietary graph to validate the solution. The argument is structured so that the only way to resolve the manufactured anxiety is to adopt the specific product being sold.
Patterns detected: ARC-0021 Fear Appeal, ARC-0012 Authority Game
The driving paradigm is the "Single Pane of Glass" fallacy—the belief that complexity can be solved through aggregation and a single numerical score. This echoes the historical trend of over-reliance on credit scores or security ratings, which can lead to "metric fixation" where security teams chase a number rather than investigating the underlying architectural vulnerabilities.
The benefit accrues to the vendor and high-level executives who receive "board-ready" numbers. The cost is borne by security analysts who may become dependent on a proprietary black-box score, potentially eroding their intuition for raw log analysis.
Bridge Questions:
1. How does the "Universal Identity Graph" handle the privacy and consent requirements of different jurisdictional laws?
2. If a score is "evidence-backed," can the underlying evidence be exported and verified by an independent third-party tool?
Counterstrike Scan: A coordinated influence campaign would use "fear-uncertainty-doubt" (FUD) regarding AI agents to force a rapid migration to a proprietary ecosystem. The content aligns with this pattern by specifically highlighting the invisibility of AI agents to existing tools as a critical vulnerability.