Hoxhunt Sense is a human risk management (HRM) solution that helps security teams identify which employees, teams, and behaviors are contributing to risk—and take action. Sense connects to the security tools you already use in read-only mode, transforms their alerts into personalized behavior patterns, and triggers nudges, training, or escalations when risky behavior continues.
Why security teams need human risk management
Security teams already collect a steady stream of low-level signals: a blocked URL, an unusual file share, or a repeated phishing simulation failure. Each one may seem minor on its own, but when the same patterns keep appearing for an employee, team, or region, they add up to a real risk. Looking at alerts one by one, it's hard to see that risk or address the behaviors behind it.
Hoxhunt Sense connects these signals by person rather than by alert, helping you focus your interventions where risk is actually building instead of where alerts happen to be the loudest.
How Sense turns security alerts into human risk insights
Hoxhunt Sense works in a continuous loop: security signals reveal behavior patterns, those patterns highlight the most important risks, and each risk leads to an automated, measurable intervention. The loop has three components.
- Dashboard gives you an organization-wide view of your risk score, risk trends, top behaviors, and where risk is concentrated across teams and departments.
- Explore helps you understand why. Filter by behavior, department, region, role, or individual employee to identify the patterns driving your risk.
- Automations help you respond to those patterns with a nudge through Microsoft Teams, Slack, or email; a targeted training assignment; a manager notification; or an escalation when a behavior continues.
Hoxhunt Sense connects incoming signals to more than 140 expert-defined behaviors across 8 categories, including social engineering, safe browsing, authentication and access management, and AI usage. Positive behaviors matter, too: threat reporting and training completion show where your people are building stronger security habits.
Additionally, Sense surfaces previously uncategorized user cohorts by creating dynamic behavior groups (people who demonstrate certain risky security behaviors) and role groups (people who share a role, even when your directory data is incomplete), so you can address similar employees at once.
Read more in Understand role groups and behavior groups.
Security tools Sense can connect to
Hoxhunt Sense connects to the security tools you already use in read-only mode, so it doesn’t replace any of them. You can set up a connection in just a few minutes, with no need to build new data pipelines.
Sense collects first-party signals from Hoxhunt training and connects to security tools like Microsoft Defender, CrowdStrike, and Zscaler through integrations. See the full list of Supported Integrations for details.
For in-house or unlisted tools, the Sense API accepts custom events, so any system that can send an event can feed Sense.
xf
Who Sense is for
Hoxhunt Sense is built for security teams at organizations that already run several security tools and want one view of the human risk those tools detect. The following groups benefit the most from Sense:
- Chief Information Security Officers (CISOs) and security leaders who need to present to the board where human risk sits and how it is changing, paired with evidence.
- Security awareness teams who need proof that the training they run actually changes human behavior, beyond completion rates.
- Security Operations Center (SOC) teams who keep seeing the same human-driven alerts from the same people.
- Insider risk and data protection teams who get signals from multiple sources but have no unified view per person.
How Sense differs from security awareness training
Security awareness training teaches employees what to do. Hoxhunt Sense measures what employees actually do across your security stack and steps in when their behavior doesn’t change.
The two work together. Sense assigns training and sends nudges based on real behavior rather than a fixed schedule. It delivers them through Hoxhunt, which employees already know from phishing simulations.
See Introduction to Security Awareness Training to learn how Hoxhunt training works on its own.
Sense complements your SIEM and data loss prevention tools
Hoxhunt Sense isn’t a security information and event management (SIEM) platform, a SOC platform, or a DLP tool. It doesn’t collect every security event or manage incident response.
Sense works upstream from these tools by addressing the recurring human behaviors behind many of their alerts. Reducing those behaviors helps lower the alert volume your SIEM and SOC need to handle in the first place.
Frequently asked questions
Does Sense install agents on employee devices?
No. Hoxhunt Sense is agentless and read-only. It uses signals your existing security tools already collect, so you don’t need to install anything on laptops or phones.
How long does it take to set up Sense?
You can get started with one integration and one use case, then expand over time. Connecting an integration only takes a few minutes, and you can run Sense in audit mode to collect data and test automations before anything reaches employees.
Can I test an automation before it reaches employees?
Yes. Save an automation in audit mode, and Sense will track how often it would have run without sending messages or assigning training. You can review the trigger logic and expected volume before it goes live.
What is a human risk score?
A human risk score is a single, behavior-based number that shows whether risk is increasing or decreasing. Hoxhunt Sense calculates a risk score for each employee, team, and department, and recalculates it for any group you filter by in Explore.
Can we control who can see employee-level data?
Yes. Only admins can access behavioral data, and role-based permissions control what each admin can see.
What you need to do
If your organization already uses Hoxhunt, contact your Customer Success Manager to enable Sense. Once you're signed in, you can read What is Sense? along with the rest of the Sense knowledge base for setup details.
If you're new to Hoxhunt, book a Sense demo to see how it works with your own security tools.
Questions?
If you have more questions, contact your Customer Success Manager or reach out to support@hoxhunt.com.