Most MSPs already know that human risk exists. The challenge is not awareness of the problem. It is knowing which users actually represent a serious, exploitable threat right now and which ones just look untidy on paper.

A user failing a phishing simulation matters. A user without MFA enabled matters. A user with privileged access matters. A user with exposed credentials matters.

But the real risk often appears when those signals overlap.

A user with high access, weak awareness signals and exposed credentials is not three separate issues. They represent a much more serious risk condition. One that could create a realistic attack path if left unresolved.

That distinction matters because it changes the conversation. It changes what you recommend, what you prioritise, and whether your clients see you as someone who runs security tools or someone who delivers security intelligence.

This is where toxic combinations come in.

What is a toxic combination in human risk?

A toxic combination is a set of user risk factors that become significantly more serious when they appear together.

Individually, each factor may look manageable. Together, they can create a critical risk scenario.

For example:

• A user has privileged access
• Their credentials have been exposed
• MFA is disabled or incomplete
• They have poor phishing simulation results
• They have not completed relevant security training

Each of these signals is useful on its own. But viewed separately, they may not trigger urgent action.

Viewed together, they tell a very different story. An attacker looking at that profile sees a privileged account with no second factor and a known credential compromise. That is not a theoretical vulnerability. That is a realistic attack path.

Toxic combination detection helps identify when multiple risk signals combine to create a higher priority issue than any one signal would suggest by itself.

Why individual risk scoring misses them

Traditional Human Risk Management has helped organisations run awareness programmes, deliver training, test users with phishing simulations and track policy activity. That activity still matters. It creates an important foundation for improving security behaviour.

But most tools today work on an additive model. They assess each factor, assign a score, and aggregate the results into a user level or control level rating. The problem with additive scoring is that it treats every factor as independent. It assumes that the sum of parts is the whole picture.

In practice, risk does not work that way. A training completion report can show who finished a course. A phishing report can show who clicked. A policy report can show who acknowledged a document. An identity signal can show who has access to sensitive systems. But these signals are often reviewed separately, which means an MSP may know a user has several risk factors but still struggle to understand whether those factors create a critical issue when combined.

This is the gap we explored in Why Human Risk Management Still Relies on Guesswork. Traditional approaches give you visibility into individual factors but leave the interpretation, the pattern recognition, and the prioritisation to the person reading the dashboard. That may work when you are reviewing a small number of users. It breaks down when you are managing risk across dozens of client organisations with hundreds or thousands of users.

From risk signals to attack paths

Attackers rarely rely on one weakness. They look for combinations.

An exposed password becomes more dangerous when MFA is missing. A phishing-prone user becomes more dangerous when they have access to sensitive systems. A dormant training issue becomes more serious when the user also has elevated privileges. A hygiene gap becomes more urgent when it sits alongside high business impact.

This is why toxic combinations are so important to Human Risk Intelligence. They help connect human, behavioural, hygiene and access signals into something closer to the way real risk develops.

In Human Risk Management vs Human Risk Intelligence, we outlined the shift from managing risk activities to generating actionable intelligence from risk signals. Toxic combination detection is one of the clearest practical examples of what that shift looks like in operation.

Human Risk Management tells you that a user has three moderate risk factors. Human Risk Intelligence tells you that those three factors, together, represent a critical exposure that needs immediate attention. One gives you data. The other gives you a priority.

For MSPs, this makes risk easier to explain. Instead of saying, "This user has a high score," they can explain what is driving the risk:

"This user is critical because weak awareness, exposed credentials and privileged access are present at the same time."

That level of attribution is essential. It makes the risk visible, explainable and actionable.

Why aggregation can hide critical risk

Many scoring models rely on aggregation. They collect individual signals, roll them into controls, and then use those control scores to calculate an overall health score.

That can be useful, but it can also create blind spots.

If several moderate issues are spread across different controls, the overall score may still appear acceptable. But those same moderate issues may create a critical condition when they affect the same user.

This is one of the biggest challenges with checklist style risk models. They can show that individual areas are broadly improving while still missing the users who create the highest practical exposure. A tenant may look healthy overall, but still contain a small group of users whose combined risk factors need urgent attention.

Toxic combination detection helps solve this by identifying when the relationship between factors matters more than the factors in isolation.

What critical risk attribution adds

Detection alone is not enough. MSPs also need to explain why a user has been classified as critical risk.

Critical risk attribution shows the specific combination of factors that caused the escalation. It turns a risk flag into an explainable finding.

This matters because MSPs need to bring customers into the conversation. A customer is more likely to act when they can see the reason behind the recommendation.

"User A has been classified as critical risk because they have privileged access, exposed credentials and incomplete MFA."

That is clear. It is defensible. It points directly to remediation.

Without attribution, a critical risk label can feel vague. With attribution, it becomes a practical next step.

Why this matters for MSPs

If you are building or scaling a human risk service, toxic combinations solve several problems at once.

Sharper customer risk reviews

Toxic combinations give MSPs a stronger basis for risk led QBRs. Instead of walking customers through isolated reports, MSPs can lead with the users or groups that need attention first.

"Here are the users creating the most exposure. Here is why they have been prioritised. Here is what we recommend fixing first."

That is a different conversation to presenting a dashboard of scores and hoping the client asks the right questions.

Clearer remediation conversations

If a user is critical because of exposed credentials, missing MFA and privileged access, the remediation path becomes obvious. The MSP can recommend specific actions: enabling MFA, reviewing permissions, resetting exposed credentials, assigning targeted training or increasing monitoring.

Toxic combinations connect findings to action. They remove the ambiguity that slows remediation down.

Ongoing engagement, not one off assessments

Toxic combinations are not static. Users change roles. Credentials appear in new breaches. Training lapses. MFA gets disabled during a migration and never gets re enabled. The combinations shift over time, which means the monitoring and response needs to be continuous.

That is a natural fit for a managed service model. It justifies recurring engagement because the risk landscape is always moving, and the MSP is the one tracking it.

Service differentiation

Any MSP can run awareness training and report on completion rates. Surfacing compound risk patterns that are difficult for internal teams to spot manually is a fundamentally different value proposition.

Customers often struggle to understand the difference between security activity and measurable risk reduction. Toxic combinations help MSPs demonstrate not just that users completed activities, but that high priority risk conditions were identified, addressed and reduced over time.

When you explain a toxic combination to a client, you are not describing an abstract score. You are describing how an attacker would actually approach their environment. That resonance is what turns a security conversation into a budget conversation.

Where toxic combinations fit in the bigger picture

As we outlined in What is Human Risk Intelligence, HRI is built around connecting signals across four risk pillars: Target, Awareness, Hygiene, and Access. These pillars mirror the way attackers actually operate. Who is worth targeting? Can they be socially engineered? Are their credentials compromised? What can be accessed if they are?

Toxic combinations work across these pillars. They surface the users where multiple pillars show weakness simultaneously, which is exactly where real world breaches concentrate. A single weak pillar is a gap. Multiple weak pillars on the same user is an opportunity for an attacker and a priority for the MSP.

This is the evolution from factor level reporting to genuine risk intelligence. Not just what is wrong, but what is dangerous. Not just where the gaps are, but where the gaps overlap in ways that create real exposure.

What this means if you're managing risk in-house

Everything above has been framed from the MSP's perspective. But the same logic applies if you're the one managing risk directly.

The same blind spot applies: your team may be tracking phishing results, MFA adoption, access levels and credential exposure separately, and each report can look manageable on its own. The risk is in the overlap. A user who fails on two or three of these fronts at once is not a collection of minor issues to work through eventually. They are your most exploitable account right now. Asking "which of our users have multiple risk factors stacking together" is a more useful question than asking "which factors need improvement this quarter."

The bottom line

Human Risk Intelligence is only as credible as the risks it surfaces.

If a platform evaluates every factor independently and never accounts for the way those factors combine, it will miss the users who matter most. Health scores will look artificially healthy. Dashboards will show moderate risk where critical risk actually exists. And MSPs will lack the visibility they need to have the conversations that drive real security outcomes and real commercial value.

Toxic combinations are more than a feature. They are becoming a fundamental requirement for any platform that claims to deliver Human Risk Intelligence. They represent the shift from counting what is wrong to understanding what is dangerous.

For MSPs, that means stronger customer conversations, more targeted remediation and a clearer way to prove value. For everyone managing risk directly, it means finally being able to answer: which of our users need attention first?

That is where Human Risk Intelligence becomes practical.

‍