Introducing Risk Signal Ingestion: Bring Real-World Security Signals Into Human Risk Management

Most CISOs have spent the last few years building out serious identity and detection infrastructure, including IdPs, EDR, SIEM, and more, all of it generating real-time signals about what's actually happening to your users.

And until now, human risk management has sat off to the side of all that, still asking the same question: Did they click the phishing test?

Today we're introducing Risk Signal Ingestion, a new capability in Doppel Human Risk Management that connects your identity and security stack directly to your human risk model, so risk scores reflect what's actually happening to each employee, not just how they perform on a quarterly simulation.

Read on to see why phishing-click rates and training completion only tell part of the human risk story, how Risk Signal Ingestion closes that gap by pulling real identity and security signals into your risk model, and what that unlocks in terms of automated, targeted intervention.

Human risk is bigger than a phishing click

For years, HRM programs have leaned on the same handful of metrics: simulation click rates, training completion, and whatever a compliance checklist says counts as "aware." While those are useful, they’re woefully incomplete.

Two employees can have identical, spotless phishing simulation histories (e.g., zero clicks, all modules done) and still carry very different levels of real risk.

One of them might be a systems administrator who just had a suspicious sign-in from an unrecognized device, reset their MFA, and approved an OAuth request from an unverified app. Under a traditional HRM model, both employees get the same score and the same generic training.

That's the blind spot Risk Signal Ingestion is built to close.

How Risk Signal Ingestion works

At launch, Risk Signal Ingestion connects Doppel directly to Okta and Microsoft Entra ID, pulling in identity and access events.

That includes things like:

• Authentication activity: Risky sign-ins, impossible travel, logins from unrecognized devices
• Credential and MFA changes: MFA enrollment or disablement, password resets, account lockouts
• Account and privilege changes: Lifecycle events, group or application assignments, privilege grants
• OAuth consent: Third-party app authorization activity

Doppel pulls these events through customer-authorized, read-only integrations, normalizes them into a vendor-neutral taxonomy, and correlates each one with the right employee.

From there, they become additional evidence in that person's risk profile alongside the behavior Doppel already observes directly through simulations, training, and phishing reporting. And security teams can create rules directly in Doppel to automatically assign training or trigger simulation campaigns to help address risky behavior.

That’s just the starting point. The broader roadmap for Risk Signal Ingestion extends to workspace, endpoint/browser, email security, and HR data, building toward a unified risk model informed by the security systems organizations already run.

A risk score built on behavior, not raw events

Generating more signals isn't automatically better. When you feed a risk engine every login event, you get noise, not insight.

That’s why Risk Signal Ingestion is built around a few core principles:

• Severity-aware: A risky sign-in paired with an MFA reset and an OAuth grant carries a lot more weight than one routine anomaly.
• Recency-aware: Recent events matter more. Older signals decay over time using Bayesian smoothing, to help limit the impact of isolated events.
• Anchored to observed behavior: External signals enrich the risk score, not override it. Doppel deliberately keeps the combined weight of ingested signals below what we directly observe: clicks, credential submissions, and severe voice outcomes from real simulations.
• Explainable: Every score movement driven by Risk Signal Ingestion is traceable back to the specific event, rule, source, and severity weight behind it. No black-box scoring.

From signal to action

Seeing the risk is only half the value. Risk Signal Ingestion also lets security teams set rules that turn a signal into an intervention automatically.

For example: An identity provider logs an MFA reset and a risky sign-in for a privileged user. Instead of that sitting in a SOC queue, Risk Signal Ingestion can:

1. Correlate the event to the user and update their risk score
2. Trigger a targeted micro-simulation reflecting current attacker tactics (like a helpdesk impersonation attempt)
3. Route the employee into dynamic coaching or prompt step-up verification

That's the shift Risk Signal Ingestion enables: from generic, calendar-driven training to just-in-time intervention based on what's actually happening to that person right now.

Built read-only by design

Connecting a human risk platform to core identity infrastructure means carefully scoping access and data protection controls.

Risk Signal Ingestion is built around a few non-negotiables:

• Read-only, least-privilege access: The initial Okta and Microsoft Entra ID integrations use read-only access, so Doppel doesn’t need write access to your identity provider or directory.
• Outbound-only collection: Nothing is installed in your environment, and no inbound path is opened.
• Metadata only: This includes event type, timestamp, risk level, and user ID. No mailbox contents, files, documents, or message bodies. PII is minimized after correlation.
• Encrypted, tenant-isolated storage, with provider credentials protected separately from application data.
• Full customer control to disable an integration or revoke access at any time.

Available now

Human risk is much more than a training problem. Attackers are already using AI to run personalized, multi-channel campaigns at scale, and evaluating human susceptibility with a quarterly phishing test and a spreadsheet isn't going to keep up.

Risk Signal Ingestion gives you an updated, explainable picture of where exposure lives in your organization and a way to act on it before it turns into an incident.

Risk Signal Ingestion is available today to HRM Pro, Simulation Pro, and Training Pro customers or standalone, with Okta and Microsoft Entra ID as the initial direct integrations. Additional signal sources, including endpoint, email security, workspace, and HR data, are on the roadmap and will be prioritized based on customer feedback.

Want to see what this looks like connected to your own stack? Request a demo.