What the User record is and how to use it

This article explains what the User record is, how to access it, what each tab shows, how the period filter works and which downloads it offers.

What the User record is

The User record is the entry point to each person in the organization. It brings together in one place everything that happened on the platform with that person:

• Their data and their groupings.
• The awareness training assigned to them and how they progressed.
• How they responded to attack simulations.
• Their risk level.
• The nudges and playbooks triggered by their behavior.
• Their activity on the platform, including their logins.

The record is read-only and requires no configuration. Its content depends on the components your organization has contracted: each tab appears when there is a component that feeds it.

For groups, functional areas and hierarchy levels there is the Grouping record. You can find it in the following article: What the Grouping record is and how to use it.

Before you begin

To open the record, your role needs the View permission. Some actions also require the Manage users and groups permission:

• The Edit user button.
• The External identifiers block in the Data tab.

How to open the User record

From the user list

1. From the sidebar, go to People > Users.
2. Find the person using the table filters or search.
3. Click their name in the User column.

A person's name takes you to their record wherever it appears as a link on the platform, including:

• The Manager column in People > Users, which opens the manager's record.
• The Priority users for intervention and Awareness champions reports.
• The Experience points ranking and Badges ranking reports in Gamification.
• Audit > Assigned actions > Users > Campaigns by user and the lists in Audit > Assigned actions > Users > Components.
• The user lists in the Grouping record.

From Reports

The record is also available in:

• Reports > All reports, in the Adoption and activity card, for any organization.
• Reports > Risk and behavior > User record, when your organization has contracted Risk Scoring.

When opened from Reports, the record shows no one until you choose a person:

1. Click the User search box in the header.
2. Type at least two letters of the first name, last name or username.
3. Select the person in the results list.

The header search only offers active users. To open the record of an inactive user, find them in People > Users by filtering by status.

The header

The header stays fixed while you move through the tabs. It shows:

• The person's name, username, email and Manager.
• The account status: Active or Inactive.
• A badge when the person appears in one of the reports that name people: Priority for intervention if their risk level is High or Very high, or Awareness champion if they meet all the conditions of that report. Clicking the badge opens the corresponding report. If they do not appear in either, no badge is shown. The badge requires Risk Scoring.

On the right are the User search box, the Period selector, the Download menu and the Edit user button. When you save or cancel the edit, the platform returns to the record.

Tabs

The Data and Activity tabs always appear. The others appear only when your organization has contracted one of the components that feed them:

Each tab loads only when you open it. Tables can be searched and filtered, and cover the person's entire history, with no limit.

Data

Who the person is and how the platform reaches them, in four cards:

• General information: Name, User, Email, Employee ID, Language, Role and Manager. The Manager is a link to their own record.
• Account status: Status, Creation date and Last access, which shows "Never accessed" if the person has never signed in. The Account origin appears only when the account was created through a path that leaves a mark on the profile, such as a SMARTFENSE CITIZEN portal or access from another instance. An import or a synchronization does not record it.
• Groupings: their Functional Areas, Levels of Hierarchy and Groups, each linked to its record, and their Smart Groups if your organization has contracted them.
• Contact channels: whether they have an email address, and their status in Slack and Microsoft Teams when your organization has those integrations. If the person is missing a channel, the card indicates what they stop receiving as a result. For roles with Manage users and groups, it also includes the External identifiers, such as the Microsoft Entra ID Object ID, the Google ID, the Identity provider ID and the LMS ID.

Awareness

• Status of their awareness training: how many assignments they have, how they are distributed by progress and how many are overdue.
• Exam scores, if your organization has Exams: average, highest and lowest score, out of 100. The score of the last attempt of each exam is used.
• Awareness assignments: one row per assignment, with the Content, Component, Progress, Result, Deadline, Assignment date and Expiration date columns. The table opens sorted with overdue assignments first. The content name opens the detail of that campaign for the person, and the Campaign history button takes you to their full history.
• Content completed on their own: content they consumed on their own initiative, outside any campaign, with its progress (Started or Finished) and the date of the last interaction.

Unfinished assignments of content the platform no longer delivers are not listed, for example because it was deactivated or removed from the organization's catalogs. For this reason, the pending items in the record may be fewer than those in the Assigned awareness status report.

Behavior

• How they respond to simulations: how many simulations they received, how many they fell for and how many they reported. Falling for and reporting are counted separately, because both can happen in the same simulation.
• Resilience: how many simulations they report for each one they fall for. It is measured only on simulations that allow reporting (Phishing and Ransomware). It is shown as:
  • Strong: 2 or more.
  • Medium: from 0.5 to less than 2.
  • Weak: less than 0.5.
• Behavior in simulations, below resilience:
  • Repeat offender: fell for the last two.
  • To watch: fell for the last one.
  • Improving: fell for earlier ones, but not the last one.
  • Solid: did not fall for any.
• Reporting habit, if your organization has the Phishing report button: the emails the person reported on their own and what each one turned out to be.
• Simulations received: one row per simulation, with the Content, Component, Fell for it, How far they went, Report and Sent date columns. If the person fell for any, the table opens filtered by Fell for it: remove the filter to see all of them.

USB Drop simulations do not appear in this tab: the device is not delivered to a specific person, so the platform cannot attribute it to anyone. Software-generated interactions, such as a security system opening a link, are not counted either.

Risk

The SMARTFENSE Scoring card shows the person's Risk Scoring:

• The current score with its level: Low, Medium low, Medium high, High or Very high. A higher score indicates more risk.
• The trend compared with the average of the previous 30 days: Worsening, Improving or Stable over the last month.
• A chart with its evolution.

The Risk Scoring detail button opens the detail with the factors that make it up. To interpret it, see the following article: Risk Scoring.

Nudges

• Coaching received: how many nudges the platform sent them, how many failed to be delivered, the date of the last one and how many were triggered by risky behavior, by positive behavior or by neither.
• Nudge detail: one row per nudge, with the Nudge, Trigger, Behavior type, Delivery and Sent date columns.

A failed delivery is a channel problem, not something the person did.

Playbooks

• Playbooks triggered: how many executions the person's behavior caused, how many ended with an error, the date of the last one and the Most executed playbooks. One execution is counted per action: a playbook with three actions counts as three.
• Execution detail: one row per execution, with the Playbook, Trigger, Action, Result and Date columns.

An error belongs to the target integration, not to the person. The message of each error can be checked in Applications > Playbooks > Playbooks Dashboard.

Activity

• Relationship with content: how many interactions they have, the First interaction, the Last interaction, the Months with interactions and their month-by-month cadence. A badge indicates With recent content consumption or No content consumed in months (after 120 days without consuming content). Test campaigns and anything an antivirus or email filter recorded on their behalf are not counted.
• What time they respond: the time of day they usually interact, in the organization's time zone. The time slot is shown from 20 interactions onwards.
• Account activity: the number of logins and the date of the last one, the failed or blocked login attempts, and a table with all account events: logins, password requests and changes, enabling and disabling two-step verification and language changes, with who requested each change.
• Gamification, if your organization has contracted it: their experience points, their level and their badges.

The Account activity figure counts only logins, while the table lists all events. To see only logins, filter the table by Type.

The period filter

The Period selector limits the record to what happened within a time frame. It offers Entire history (default value), Last 30 days, Last 90 days and Last 12 months.

The period limits events, not the current status:

• It applies to Awareness, Behavior, Nudges, Playbooks and Activity. In these tabs, each figure and each table count only what happened within the time frame.
• It does not apply to Data or Risk, which describe the current situation.

For example, if you choose Last 30 days in the record of a person with a High risk level, the Behavior tab counts only the simulations sent in those 30 days. The Risk tab, however, still shows their current High level and their entire evolution.

Also keep in mind that:

• In Awareness, the period applies to the assignment date. An assignment prior to the time frame does not appear, even if it is still overdue.
• Three indicators describe the present and are not limited: Behavior in simulations, the content consumption badge and the Gamification level. The record notes this next to each one when a period is selected.
• If a card is empty because of the period, the record indicates it and suggests widening it.
• The period is part of the screen address: a shared link opens the record with the same period. It is also kept when you change person with the header search.

Downloads

CSV of each table

Cards with a table have a CSV button. The file contains the same data the table is showing: it respects the selected period and the filters or search applied. The platform prepares the file in the background and notifies you when it is ready.

If the table opened filtered, for example by Fell for it, the file includes that filter until you remove it.

The record as a PDF

1. Click Download and select As PDF.
2. Wait while the screen goes through the tabs to build the document. When finished, it returns to the tab you were on.

The document respects the selected period and shows it on the cover. The last page defines the terms used in the document.

For each table, the PDF includes only the page you are viewing on screen. For the full detail, use the CSV or the evidence package.

Evidence package

It gathers in a single compressed file everything the record shows about the person, so you can work with it in a spreadsheet or submit it as evidence.

1. Click Download and select Evidence (.zip).
2. Wait while the platform builds the file. The screen shows the progress.
3. Download the file when it is ready.

The download link expires after 15 minutes.

The .zip file contains a folder named after the person's username and, inside it:

• resumen.csv: all the figures in the record, one row per data point, with the tab and card each one comes from.
• One CSV file per list, with the same content as its CSV button: concientizacion_asignaciones.csv, concientizacion_proactivo.csv, comportamiento_simulaciones.csv, nudges.csv, playbooks.csv, actividad_cuenta.csv, actividad_intentos_fallidos.csv and actividad_gamificacion.csv. Only those for the tabs and cards your organization has are included.
• LEEME.txt: who the package belongs to, when it was generated, what period it covers and what each file contains.

The package respects the selected period, but not the table filters. A list with no data does not generate a file. If the package exceeds the maximum size, the lists left out are named in LEEME.txt: narrow the period and download it again.

Special cases

A person with no activity

The record opens anyway. Each card without data says so, for example: "Has not received any attack simulation yet.". In Nudges and Playbooks it distinguishes whether the person's behavior did not trigger any or whether the organization has none active. In Risk, a person without a calculated score shows "No risk history yet.".

An inactive user

The record opens from People > Users and shows their entire history, with the Inactive status in the header. The header search does not offer them, because it only lists active users.

💡 Best practices

• Open the User record before a follow-up conversation: it brings together on one screen the person's risk, simulation history and awareness progress.
• Use the period to prepare periodic reviews: Last 90 days shows what happened since the previous review without losing sight of the current risk.
• To compare two people over the same time frame, first choose the period and then change person with the header search.
• Download the PDF to read or send the record, and the evidence package when you need the full detail of each list.
• To decide which records to open first, see the following article: Risk and behavior reports.