Human Risk Graph: A Quantitative Model for Organizational Security Risk

Organizations face security risks not only from technical vulnerabilities but also from human dependencies, decision concentration, and emergency bypass mechanisms. Traditional security models focus primarily on technical attack surfaces, neglecting the organizational structure itself as a source of risk. We introduce the Human Risk Graph (HRG), a graph-theoretic model that quantifies organizational security risk arising from human factors. HRG represents people as nodes and dependency relationships as edges, computing three core metrics: Bus Factor Score (organizational fragility), Decision Concentration Score (authority distribution), and Bypass Risk Score (control circumvention). We formalize the model mathematically, prove key properties, present efficient algorithms with complexity analysis, and validate the approach through experiments on synthetic and real-world organizational structures. Our results demonstrate that HRG effectively identifies human single points of failure and provides actionable insights for security risk mitigation. The model has applications in insider threat assessment, business continuity planning, and security architecture evaluation.