> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/insights/risks/identity-risk.md). # Identity Risk Rank identities by composite risk score, and break down risky identities by identity type, risk score range, and integration. {% hint style="info" %} **Early Access**: The **Identity Risk** tab requires enablement by Veza. Contact your account team to turn it on for your tenant. If not enabled, the **Risks** page shows only the **Overview** and **All Risks** tabs, and links to the Identity Risk tab open the Overview tab instead. {% endhint %} The **Overview** and **All Risks** tabs answer the question "which risk queries are firing?" The **Identity Risk** tab answers a different one: "which identities carry the most risk?" Instead of listing risk queries and the number of entities each one flags, the Identity Risk tab lists individual identities ranked by their composite [risk score](/4yItIzMvkpAvMVFAamTf/features/insights/risks.md#how-risk-scoring-works), so a person or workload that accumulates risks across many separate queries rises to the top. Widgets above the table break the risky identities down by identity type, by risk score range, and by integration, and each one filters the table when you click it. Open the tab from **Access Intelligence** > **Risks** > **Identity Risk**. ![The Identity Risk tab showing the risky identity tiles, the Identities by Risk Score and Most Identities by Integration cards, and the top of the risky identities table.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-56b655b8ca7f5fb334cda70e94616a2b041f0842%2Frisks-identity-risk-tab.png?alt=media) The tab covers all identity types, including human identities, non-human identities, and AI agents. Viewing the tab requires the same permission as the rest of the **Risks** page. ### Risky identity tiles Four tiles at the top of the tab count your risky identities by identity type: | Tile | What it counts | | -------------------------- | ------------------------------------------------------------------------ | | **Total Risky Identities** | Every identity with a risk score, across all integrations | | **Human Risky Identities** | Risky identities with an identity type of Human | | **NHI Risky Identities** | Risky identities with an identity type of Non-Human, excluding AI agents | | **Agent Risky Identities** | Risky identities with the AI Agent identity subtype | AI agents are counted on the **Agent Risky Identities** tile only, not on the **NHI Risky Identities** tile. Identities without a risk score are not counted on any tile. Click a tile to filter the risky identities table to that set of identities. The page scrolls to the table, and the applied filter appears above it. Click **Total Risky Identities** to clear the filters and show every risky identity again. ### Identities by Risk Score The **Identities by Risk Score** card groups risky identities by score range, with a row and a donut segment for each range. Each range matches one of the risk-score bands described in [How risk scoring works](/4yItIzMvkpAvMVFAamTf/features/insights/risks.md#how-risk-scoring-works): | Row | Risk band | | ---------- | --------- | | **100-75** | Critical | | **74-50** | High | | **49-25** | Medium | | **24-10** | Low | An identity's band is set by the most severe risk query it matches, and each additional risk raises its score within that band. For example, an identity that matches several High queries scores higher than one that matches a single High query, but both appear in the **74-50** row. Additional risks move an identity into a higher band only at very large counts, such as an identity that matches 60 or more Low queries and nothing more severe, which reaches the **49-25** row. Click a row's count to filter the table to identities in that band. ### Most Identities by Integration The **Most Identities by Integration** card lists the five integration types with the most risky identities. Each row shows the integration logo and name, the number of risky identities, and a bar sized relative to the largest integration. The card groups identities by integration type, such as Azure or AWS, so all of your Azure integrations count toward a single **Azure** row. Integration types outside the top five are not shown on the card. Click a row's count to filter the table to identities from that integration type. {% hint style="info" %} Clicking a tile or a widget row replaces any filters you applied to the table with that widget's filter. To combine conditions, click the widget first, and then add column filters on the table. {% endhint %} ### Risky identities table The table at the bottom of the tab lists every identity with a risk score above zero, sorted by **Risk Score** in descending order, so the highest-scoring identities appear first. ![The risky identities table showing the Name, Integration, Type, and Risk Score columns.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-63ebca793aad5f42677a109ae7abb368c879a994%2Frisks-identity-risk-table.png?alt=media) The **Integration** column shows the name of the integration each identity comes from. Click the name to open that integration's details page. When Veza cannot match an identity to a specific integration, the column shows the integration type, such as Azure, without a link. The table is the standard Query Builder results table, which means: * Click a **Risk Score** value to open the risk-score breakdown, showing which risk queries contribute to that identity's score. * Click an identity name to open its details panel. * Use the **Type** column filter to narrow the results to a specific identity type. * Use the column selector to choose which columns to show, and the column filters to narrow results further. * Click **Export** to save the results as a CSV file or send them by email. When you click a tile or widget row, the table shows the matching identities and the filter applied above it. Click the **x** on the filter to remove it. ![The risky identities table filtered to AI agents after clicking the Agent Risky Identities tile.](https://1967633068-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MZDkWMxox3pekd0NsZJ%2Fuploads%2Fgit-blob-fc42bc6e941215dab114ec4f4906aefc32035d4b%2Frisks-identity-risk-filtered.png?alt=media) For details on the results table, its columns, and its row actions, see [Query Builder](/4yItIzMvkpAvMVFAamTf/features/search/query-builder.md). ### How identities are scored An identity's risk score is the composite score Veza calculates for any entity, based on the number and severity of the risk queries it matches. The algorithm, the band thresholds, and worked examples are documented in [How risk scoring works](/4yItIzMvkpAvMVFAamTf/features/insights/risks.md#how-risk-scoring-works). Assigning risk levels to queries is what drives these scores. If the tab shows fewer identities than you expect, check that the queries covering your environment have risk levels assigned; see [Configure risk levels and profiles](/4yItIzMvkpAvMVFAamTf/features/insights/risks/configure-risk-levels-and-profiles.md). {% hint style="info" %} When your environment has more than one identity provider, one person appears as a separate identity in each provider, and each of those identities is scored on its own. See [Risk coverage across multiple identity providers](/4yItIzMvkpAvMVFAamTf/features/insights/risks.md#risk-coverage-across-multiple-identity-providers). {% endhint %} ### Limitations * **Counts refresh once a day**: the tiles, the widgets, and the table read a result set materialized once daily, rather than querying Access Graph at the moment you open the tab. Counts here can differ from the **All Risks** tab, which reflects more recent query evaluations. Expect the difference to resolve after the next daily refresh. * **No trend over time yet**: the tab shows current counts only. To track how open and resolved risks change over time across all risk queries, use the **Open & Resolved Risks** chart on the **Overview** tab. * **Widgets group by integration type, not by individual integration instance**: if you connect several integrations of the same type, the **Most Identities by Integration** card combines them into one row. Use the **Integration** column on the table to see which integration each identity belongs to. * **Identities only**: the tab covers entities of the Identity super type. Risks affecting other entity types, such as data resources or applications, appear on the **Overview** and **All Risks** tabs but not here. ### See also * [Access Risks](/4yItIzMvkpAvMVFAamTf/features/insights/risks.md) * [Investigate risks](/4yItIzMvkpAvMVFAamTf/features/insights/risks/investigate-risks.md) * [Configure risk levels and profiles](/4yItIzMvkpAvMVFAamTf/features/insights/risks/configure-risk-levels-and-profiles.md) * [Manage risk exceptions](/4yItIzMvkpAvMVFAamTf/features/insights/risks/manage-risk-exceptions.md) * [My Focus](/4yItIzMvkpAvMVFAamTf/features/insights/dashboards/my-focus.md) * [Query Builder](/4yItIzMvkpAvMVFAamTf/features/search/query-builder.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/features/insights/risks/identity-risk.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.