Unified identity security platform provider Permiso Security Inc. today launched the Risk Score Engine, a model that assigns continuous, multidimensional risk scores to every human, machine and artificial intelligence identity across an organization’s environment.

The tool produces three outputs. Identity Risk Scores rank which identities carry the most risk, Session Scores flag activity that needs immediate investigation, and Organization Risk Scores roll everything into a single tenant-level metric that can be benchmarked against peers. Permiso likens the result to a FICO credit score for identity risk.

The pitch addresses a question Permiso argues most security teams still cannot answer: Across every environment, what is an organization’s overall identity risk and what is driving it? Getting there requires visibility into every identity type plus runtime data on what each identity is doing at any given moment. Most organizations have neither, the company says. Instead, they assign identities a fixed risk tier based on privilege level or lean on alerts that fire only after a detection.

Each identity gets a score from 0 to 100, built from three separate measures. One tracks behavior and flags when an identity does something out of character. A second estimates how likely the identity is to be compromised. The third weighs impact, meaning how much damage it could do if misused. Permiso says keeping the measures separate is the point. Two identities can land on the same composite score for very different reasons. The breakdown tells a team which one to chase first.

The score draws on static posture data, such as privilege levels, credential hygiene and entitlement scope. On top of that, it layers runtime signals: active anomalies, threat intelligence hits and the context of how an identity authenticated. Session-level scoring runs on separate suspicion and impact axes, letting security operations teams triage active sessions on current behavior independent of an identity’s history. A score velocity feature watches the rate of change itself, aiming to catch compromise sequences that unfold over minutes rather than days.

The engine scores human users the same way it scores the machine identities that now outnumber them, among them service accounts, application programming interface keys, OAuth tokens and identity and access management roles. AI agents get the same treatment. Permiso calls agents the fastest-growing and least-governed identity class in the enterprise. The system is built on Permiso’s Universal Identity Graph, which correlates identity behavior across identity providers, cloud accounts and on-premises infrastructure.

“The identity security market has lacked a consistent, quantifiable way to measure risk across all identity types,” said Chris Kissel, research vice president of security products at International Data Corp. “Continuous scoring that combines posture, behavior and context into a single model is where the industry needs to go and it is a meaningful step beyond what legacy ITDR and ISPM tools offer today.”

Permiso co-founder and Chief Executive Paul Nguyen said static labels and one-alert-at-a-time triage do not scale against a global workforce, sprawling nonhuman identities and a growing roster of AI agents.

The Risk Score Engine is available now as part of the Permiso platform.

Image: Permiso