Human Risk Graph · example

Human Risk Graph · example_organization.json

DModerate risk

Main driver: key-person risk — Bus factor 1. Losing Anna Mueller cuts off 3 people and 50% of connections.

Human dependency risks are manageable; the top fixes below are worth doing.

10 people14 dependencies 3 errors · 6 warningsmodel hrg-22026-11-13 09:26

Key-person risk Moderate

Bus factor 1

Losing Anna Mueller cuts off 3 people and 50% of connections.

Approval concentration Moderate

3.5 effective approvers

of 5; Luca Rossi holds 44% of approval weight.

Override exposure Moderate

4 of 7 critical approvals

can be overridden through a bypass.

Top fixes

Remediations simulated on your data, ranked by how much they raise the score.

Doing all 3 raises the score from 52 to 76 (grade D → C).

1
Bypass control
Require a second person for Elena Popescu's bypass of Anna Mueller

bypass involving a critical person

+8 52 → 60
2
Deputy
Add a deputy for Anna Mueller

single point of failure, cuts off 3 people

+6 60 → 66
3
Deputy
Add a deputy for Luca Rossi

single point of failure, cuts off 2 people

+10 66 → 76

Simulated on the model: a deputy shares the person's approvals and escalations; a bypass control means no single person can override, so the bypass is removed.

Dependency map

Who approves, escalates to and can bypass whom. Select a person for details.

Critical single point of failure Single point of failure Critical (≥ threshold) Other Approval Escalation Bypass Moving dots run from who approves, escalates or bypasses to whom · Select a key person: the people cut off without them pulse red · Node size: criticality and impact · Drag to pan when zoomed

People

Impact is the share of connections between the others that depend on the person.

Person	Criticality	Impact	Cuts off	Approval share	Flags
Anna Mueller Security Lead	0.85	50%	3	23%	SPOFcritical
Luca Rossi Principal SRE	0.92	39%	2	44%	SPOFcritical
Johan Lindberg DevOps Engineer	0.58	39%	2	6%	SPOF
Marie Dubois Engineering Manager	0.78	22%	1	11%	SPOFcritical
Ines Silva Product Security Engineer	0.55	22%	1	—	SPOF
Carlos Garcia Platform Architect	0.74	—	—	16%	critical
Elena Popescu Incident Manager	0.69	—	—	—
Peter Novak Backend Lead	0.66	—	—	—
Sofia Papadopoulos Compliance Officer	0.63	—	—	—
Tomas Kowalski Software Engineer	0.50	—	—	—

Findings

3 errors · 6 warnings, with related ISO/IEC 27001, SOC 2 and DORA controls.

Related controls are informative pointers for audits, not an assessment of compliance.

HRG001 Single point of failure 5

errorAnna Mueller (anna.mueller) is a single point of failure (criticality 0.85): losing them cuts off 3 people and 50% of the connections between the others.
warningInes Silva (ines.silva) is a single point of failure (criticality 0.55): losing them cuts off 1 person and 22% of the connections between the others.
warningJohan Lindberg (johan.lindberg) is a single point of failure (criticality 0.58): losing them cuts off 2 people and 39% of the connections between the others.
errorLuca Rossi (luca.rossi) is a single point of failure (criticality 0.92): losing them cuts off 2 people and 39% of the connections between the others.
errorMarie Dubois (marie.dubois) is a single point of failure (criticality 0.78): losing them cuts off 1 person and 22% of the connections between the others.

Remediation. Name a deputy, cross-train them, and document the approvals and emergency procedures this person handles.

ISO/IEC 27001:2022A.5.29A.5.30

SOC 2 (2017 Trust Services Criteria)CC1.4CC9.1

DORA (Regulation (EU) 2022/2554)Art. 10(1)Art. 11(2)(a)

HRG002 Concentrated approval authority 1

warningApproval authority is concentrated (3.5 effective approvers of 5); Luca Rossi (luca.rossi) holds 44% of the approval weight.

Remediation. Add secondary approvers for sensitive workflows and spread ownership of high-impact decisions.

ISO/IEC 27001:2022A.5.2A.5.3

SOC 2 (2017 Trust Services Criteria)CC1.3CC5.1

DORA (Regulation (EU) 2022/2554)Art. 5(2)(c)Art. 6(4)

HRG003 Bypass involving a critical person 3

warningElena Popescu (elena.popescu) can bypass Anna Mueller (anna.mueller) and override the controls they enforce; one of them is critical.
warningLuca Rossi (luca.rossi) can bypass Carlos Garcia (carlos.garcia) and override the controls they enforce; one of them is critical.
warningMarie Dubois (marie.dubois) can bypass Carlos Garcia (carlos.garcia) and override the controls they enforce; one of them is critical.

Remediation. Require a second person for the bypass, log every use, and review each use after the fact.

ISO/IEC 27001:2022A.5.3A.8.2A.8.32

SOC 2 (2017 Trust Services Criteria)CC5.1CC6.3CC8.1

DORA (Regulation (EU) 2022/2554)Art. 9(4)(c)Art. 9(4)(e)

How the score is calculated

Model hrg-2.

Key-person risk K: the largest criticality × impact, where impact is the share of connections between the others that are lost without the person.
Approval concentration D: Herfindahl-Hirschman index of approval weight; 1/D is the effective number of approvers.
Override exposure B: weighted share of critical approvals whose approver can be bypassed.

Composite risk = (1 − (1 − 0.4·K)(1 − 0.3·D)(1 − 0.3·B)) / (1 − (1 − 0.4)(1 − 0.3)(1 − 0.3)) = 0.476; score = 100·(1 − risk) = 52

Metric	Value	Weight
Key-person risk	0.425	40%
Approval concentration	0.287	30%
Override exposure	0.416	30%
Composite risk	0.476

Grades: A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 50, F below 50. Full definitions and properties: docs/model.md.

Audit trail

Enough to reproduce this result.

Input file	`example_organization.json`
Input SHA-256	`824985be282b635f6b341a91b8731172b1c7e8d0b62f723b4ef0c631da1e1034`
Generated	`2026-11-13T09:26:35`
Tool	`human-risk-graph 0.14.0`
Model	`hrg-2`
Weights	`α 0.4 · β 0.3 · γ 0.3`
Critical threshold	`0.7`
Config	`none`
Unconfirmed dependencies	`0`
Data gaps	`0`
People / dependencies	`10 / 14`