<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-identity-risk-scoring
description: >-
  Implement identity risk scoring models that combine behavioral analytics,
  credential hygiene, privilege level, and threat intelligence to produce
  continuous risk scores for every identity in the environment.
domain: cybersecurity
subdomain: identity-security
tags:
  - identity-risk-scoring
  - ueba
  - behavioral-analytics
  - risk-model
  - machine-learning
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1110
  - T1098
  - T1550
  - T1556
---

# Performing Identity Risk Scoring

## Overview

Identity risk scoring assigns a continuous risk value to every identity based
on behavioral patterns, credential hygiene, privilege level, and external
threat signals. Scores drive adaptive authentication decisions, access review
prioritization, and incident response triage.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### Risk Score Components

```python
RISK_MODEL = {
    "behavioral_score": {
        "weight": 0.30,
        "factors": [
            "auth_pattern_deviation",
            "resource_access_anomaly",
            "session_behavior",
            "time_of_day_anomaly",
        ],
    },
    "credential_score": {
        "weight": 0.25,
        "factors": [
            "password_age",
            "mfa_strength",
            "breach_exposure",
            "credential_reuse",
        ],
    },
    "privilege_score": {
        "weight": 0.25,
        "factors": [
            "admin_role_count",
            "standing_access_duration",
            "service_principal_permissions",
            "cross_tenant_access",
        ],
    },
    "threat_intel_score": {
        "weight": 0.20,
        "factors": [
            "ip_reputation",
            "known_campaign_indicators",
            "dark_web_exposure",
            "geo_risk",
        ],
    },
}
```

### Risk Tiers

| Tier | Score Range | Action |
|---|---|---|
| Critical | 90-100 | Immediate investigation, account lock |
| High | 70-89 | Priority review, step-up auth required |
| Medium | 40-69 | Enhanced monitoring, scheduled review |
| Low | 0-39 | Standard monitoring, routine review |

## Workflow

```
1. MODEL      — Define risk factors, weights, and scoring algorithm
2. COLLECT    — Gather identity signals from all data sources
3. BASELINE   — Establish per-identity behavioral baselines
4. SCORE      — Calculate continuous risk scores for all identities
5. TIER       — Assign risk tiers and trigger corresponding actions
6. INTEGRATE  — Feed scores into adaptive auth and access reviews
7. CALIBRATE  — Tune model based on true positive / false positive feedback
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
