If you’re setting it up for the first time, you can navigate to Analytics > Overview > Human risk intelligence > Enable human risk intelligence to go through the essential onboarding flow. This is enough to get you set up for the launch. The flow has three steps: Training strategy, Behavior-triggered interventions, and a final review before you enable the system.
Alternatively, you can go directly to Settings > Human risk intelligence to activate HRI. This is also where you can adjust the settings you selected in the onboarding flow and find advanced optional settings. This guide focuses on that specific view and explains every available setting.
Before you begin
HRI works by analyzing employee security behavior over time before assigning training. No lessons are assigned immediately after you enable it — the system needs 24 hours to gather signals first. You can change your settings or disable HRI at any time after setup.
Training strategy settings
The Training strategy settings define how automated training is assigned and delivered.
Training strategy
Select the strategy that best matches your organization's priorities. Three options are available:
- Risk-based training — assigns training based on each employee's job role, access level, and responsibility. Aligned with NIS2 expectations. Choose this if reducing individual risk is your primary goal.
- Compliance training — assigns training to meet documented requirements in ISO 27001, SOC 2, and related frameworks. Choose this if maintaining compliance coverage is your primary goal.
- Group-based training — adjusts training using behavior trends across teams and departments, without targeting individuals. Here, we don’t use individual employee roles, access levels, or responsibility. Choose this if you prefer not to profile employees individually. Please note that the resilience score is still calculated at the individual level, even when group-based training is selected.
Moxso can automatically assign organizational roles to employees based on their department and group data. This happens through the employee data enrichment setting in your workspace settings, not through the HRI configuration flow.
Settings > Workspace settings > Employee data enrichment
If this is not enabled, Moxso defaults to the Administration role. Read more about organizational roles in this article: What are organizational roles?
Frameworks
Select one or more compliance frameworks to map your training to. The available options are NIS2, ISO 27001, and SOC 2. You can combine frameworks. For example, selecting both NIS2 and ISO 27001 will align the program to cover both.
Notifications
- Enable notifications — When turned on, employees receive an email when new training is assigned. This is on by default.
- Notification cadence controls how often reminder emails are sent after a training assignment. Three options are available:
- Loose sends reminders at 28 days and 14 days before the deadline, plus a 3-days-left reminder, a last day reminder, an overdue reminder, and a missed deadline reminder. The 21-day, 7-day, and 1-day-left reminders are skipped.
- Normal sends reminders at 28 days, 21 days, 14 days, and 7 days before the deadline, plus a 3-days-left reminder, a last day reminder, an overdue reminder, and a missed deadline reminder. The 1-day-left reminder is skipped.
- Intense sends the same reminders as Normal, plus an additional 1-day-left reminder.
- Smart reminders — When turned on, Moxso automatically sends reminder emails until the employee completes the training. This is on by default.
Eligibility & Targeting
- Minimum tenure (days) — employees must have been active for at least this many days before they enter automated training flows. The default is 14 days.
- Excluded roles — use this field to exclude specific roles from automated training flows entirely.
Advanced settings
Select Show advanced settings to access additional controls.
|
Setting |
What it does |
Default |
|
Cooldown period (days) |
The minimum number of days between two training assignments. If an employee is assigned something today, they won't receive a new assignment until this period has passed, regardless of whether they completed the training. |
7 |
|
Interval (days) |
Works together with Max assignments per run to cap how much training an employee can receive or complete within a set period. For example, with an interval of 14 days and a max of 1 assignment per run, an employee can receive or complete at most 1 training item every 14 days. |
30 |
|
Avoid repeating the same training (days) |
Prevents the same lesson from being reassigned within this period |
90 |
|
Max assignments per run |
Maximum number of new training assignments per employee in one evaluation cycle |
1 |
Behavior-triggered Interventions
Interventions allow HRI to break normal assignment rules when high-risk behavior is detected. For example, assigning training immediately even if an employee recently completed other training.
Toggle Enable intervention overrides on to access the full configuration.
Intervention triggers
When intervention overrides are enabled, select which events can start an immediate notification or training assignment:
- Phishing simulation failures — starts an immediate assignment when an employee fails a phishing simulation.
- Breach exposure — starts an immediate assignment when an employee appears in a known data breach.
- Training non-compliance — starts an immediate assignment when required training is overdue.
For each trigger you enable, you can also choose what actions to take when it fires:
- Notify manager — sends a notification to the employee's manager.
- Assign new lesson — assigns a new training lesson immediately.
Intervention limits
|
Setting |
What it does |
Default |
|
Maximum interventions per employee (30 days) |
Caps how many override assignments one employee can receive in a 30-day window |
2 |
|
Intervention cooldown (days) |
Minimum number of days between intervention-based assignments for the same employee |
7 |
- Respect existing mandatory training — when turned on, intervention overrides are paused if an employee already has assigned training in progress, that is training that is not completed yet. This is on by default.
- Excluded roles — employees in these roles are never targeted by intervention overrides.
When you’re ready, click on Save settings.
