Find the people your security depends on

Human Risk Graph models who approves, who escalates and who can override a control, then shows the single points of failure, how concentrated approval authority is, which controls can be bypassed, and the changes that help most.

GitHub GitHub Action PyPI How the score works Benchmark

Live example reports

Fictional organizations, analyzed by human-risk-graph 0.14.0. Each report is a single offline HTML file: open the map, click a person, print it as PDF.

52D

Platform and security team

Ten people across SRE, security, platform and compliance, with approvals, escalations and emergency bypasses.

10 people · 14 dependencies · Moderate risk · 3 errors · 6 warnings

Top fix: Require a second person for Elena Popescu's bypass of Anna Mueller

Open the report →
25F

Small team

Five people where one head of platform approves almost everything and a bypass skips her review.

5 people · 5 dependencies · Critical risk · 3 errors · 2 warnings

Top fix: Require a second person for Bob's bypass of Alice

Open the report →
47F

Critical functions (model hrg-3)

Merge, release, database restore and key rotation: who can perform each, what stops without one person, and who can complete it alone.

4 people · 3 dependencies · High risk · 2 errors · 3 warnings

Top fix: Close the way around the two-person rule for Merge to main

Open the report →

Try it on your organization

pip install human-risk-graph
hrg analyze org.yaml                       # describe people and dependencies in YAML
hrg scan github my-org/my-repo             # or draft them from a GitHub repository

In CI, with findings in code scanning and a job summary on every pull request:

- uses: LF3551/human-risk-graph@v0.14.0
  with:
    file: org.yaml
    min-score: 70

What it is not