In short: usecure uHealth is usecure's new human risk intelligence product. It scores each person across four pillars (Target Value, Awareness, Hygiene and Access) using usecure training, phishing, policy and breach data plus Microsoft 365 or Google Workspace identity signals, highlights toxic combinations such as a privileged account without MFA, and ranks fixes by risk reduction.
What uHealth adds
Awareness platforms have always measured behaviour: who completed training, who clicked a simulation. What they rarely showed is context. A junior member of staff who clicks a simulated link is a training need. A finance director who clicks, has a leaked password and has no MFA is a likely incident.
uHealth is usecure's answer to that gap. It is the new Human Risk Intelligence layer of the usecure platform. It connects the signals from uLearn, uPhish, uPolicy and uBreach with identity, hygiene and access data from your Microsoft 365 or Google Workspace tenant, then tells you where risk sits and what to do about it. It works alongside the other products rather than replacing them.
It is a practical example of the wider human risk management approach.
The four risk pillars
| Pillar | What it looks at |
|---|---|
| Target Value | How attractive someone is to an attacker: role and seniority, financial authority and external visibility |
| Awareness | What people know and how they behave when tested: training performance, phishing outcomes and reporting behaviour |
| Hygiene | How securely identities and accounts are set up: MFA strength, exposed credentials and dormant accounts |
| Access | What an attacker could reach after a compromise: admin privileges, financial permissions and sensitive data |
Each person is assessed across all four and placed in a risk band from low through medium and high to critical. The organisation as a whole receives a Human Risk Score, so you can see whether things are improving over time.
Toxic combinations
The idea at the heart of uHealth is that weaknesses which are minor on their own can be critical together. Examples of the kinds of combination it is designed to surface:
- A senior executive whose mailbox forwards mail externally and who has no MFA, a pattern that resembles business email compromise in progress
- A privileged account whose owner fails phishing simulations and has no MFA
- An active privileged administrator account with no MFA
None of these would stand out in a training completion report. Each is exactly what an attacker looks for. For finance-specific risks, see business email compromise training.
From score to action
A risk score is only useful if it leads to action. uHealth shows the next action beside each risk and lists priority tasks ranked by how much risk they remove, not by how easy they are to close. Typical next steps include:
- Enforce MFA on an account that lacks it; see Cisco Duo MFA for stronger authentication
- Remove excess access or clean up a dormant account
- Assign a course to someone whose awareness results are weak
- Tighten a policy, such as external mail forwarding
It then reports on whether risk is falling after the fix. Notice that half of these actions are technical, not training. That is the point: human risk is reduced by changing settings as well as changing behaviour, and the technical side often sits with whoever manages your Microsoft 365 security.
Using uHealth in board and insurer reporting
Boards and insurers want to know not just whether staff are trained but whether the organisation understands where its people-related risk lies. uHealth gives you a simple story for a board report:
- The organisation's Human Risk Score and its trend
- How many people sit in the high and critical bands, and why
- The toxic combinations found and fixed this quarter
- The remaining priority actions and who owns them
Compare this with other approaches to human risk measurement, such as the Hornetsecurity Employee Security Index or Microsoft's predicted compromise rate, on our measuring security awareness training page.
Licensing and how we help
uHealth is not part of the core usecure plan, and usecure has not yet published its licensing on its pricing page. It builds on the data the other usecure products already collect, so it makes most sense once those are running. Ask us about availability and a quote.
Because uHealth's recommendations often involve identity and access changes, it pairs well with a managed service. We connect your directory, review the toxic combinations with you, carry out or schedule the technical fixes where we manage your environment, and report the trend each quarter. Contact us to see what uHealth would find in your organisation.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is usecure uHealth?
uHealth is usecure's new Human Risk Intelligence product. It combines training, phishing, policy and breach data with Microsoft 365 or Google Workspace identity signals to score people across four risk pillars and rank the fixes that reduce risk most.
What are the four uHealth risk pillars?
Target Value (how attractive someone is to attackers), Awareness (knowledge and behaviour when tested), Hygiene (MFA, exposed credentials and dormant accounts) and Access (privileges, financial permissions and sensitive data).
What is a toxic combination in uHealth?
A set of weaknesses that are minor alone but serious together, such as a privileged account that fails phishing simulations and has no MFA. uHealth highlights these so you can fix them first.
Does uHealth replace uLearn and uPhish?
No. uHealth sits alongside uLearn, uPhish, uPolicy and uBreach, which generate the awareness and exposure signals it uses.
Is uHealth included in the usecure plan?
No. The core plan covers uLearn, uPhish, uPolicy and uBreach Starter. uHealth is a newer, separate product and usecure has not published its licensing yet, so ask us about availability and a quote that covers both.