What Is an Identity Risk Score?
An identity risk score is a composite metric that ranks an account or identity by how much exposure it represents, typically built from signals like privilege level, staleness, group membership, credential hygiene (rotation history, MFA presence), and known compromise indicators. Instead of reviewing every account with equal attention, a team can triage the highest-scoring identities first.
The specific inputs and weighting vary by vendor and by organization, but the goal is consistent: turn a long, undifferentiated list of accounts into a ranked queue. A domain admin account that hasn’t rotated its password in two years and shows compromised-credential indicators should score meaningfully higher than a routine, recently-provisioned user account, and the score should make that difference visible at a glance.
A risk score is a summary of whatever inventory it was calculated against. If the underlying account inventory is incomplete or stale, the score for the accounts it does see may be accurate while the biggest risk in the environment, an account that was never in the inventory at all, never gets scored in the first place. The score is only as trustworthy as the discovery underneath it.