Privci

Human Vulnerability Scanner

The world’s first behavioural scanning engine — built to surface the conditions that quietly shape risk across organisations.

Using behavioural psychology and threat‑intelligence signals, Privci analyses how and why people behave — not just what they do — revealing the hidden vulnerabilities traditional security tools overlook.

The Hidden Risk

Year after year, human behaviour remains the leading cause of data breaches. This is despite significant investment in people, processes, and user‑focused security programmes — organisations continue to be compromised in the same familiar ways.

✗ Social engineering ✗ Credential misuse ✗ Human error ✗ Misconfiguration

The reason isn’t that people don’t know better. It’s that most security approaches focus on what people do — not why they do it.

Trust in internal authority, fatigue under pressure, shortcuts that quietly become normal — these are the conditions that shape behaviour long before an incident occurs, and until they are understood, nothing really changes.

Archetype Distribution

The Scanner

Privci’s Human Vulnerability Scanner was built to surface the conditions that quietly shape risk across organisations. It identifies dominant behavioural patterns, the pressures influencing decisions, and the norms that form over time — across individuals, teams, and the organisation as a whole. The result is clear visibility into existing routes to compromise, before they become incidents.

Start Your Free 30-Day Scan!

Inside the Human Vulnerability Scanner (HVS)

Think of a traditional security scanner. It maps your network, identifies unpatched systems, and highlights technical vulnerabilities. Privci’s Human Vulnerability Scanner does the same — but for people. It surfaces the trust, fatigue, pressure, and everyday context that quietly shape how employees make decisions, long before those decisions are exploited.

Where trust is being over-used Where fatigue is causing shortcuts What habits are forming ...
Continuous
Feedback Loop
1
Assess
2
Personalise
3
Intervene
4
Reassess

The APIR Framework

We call the engine behind the Scanner APIR—Assess, Personalise, Intervene, and Reassess. It’s a continuous loop that turns human behaviour into something you can actually measure and improve.

During the scan

15
30
90
Events & Use Cases
Challenges
Micro‑lessons
Deviation signals
Phishing sims ...

Assess

The Scanner begins by learning how your organisation actually works. You can upload existing internal security policies or use Privci’s policy builder. This ensures the model reflects your environment — not a generic baseline. Over a period of 15 to 90 days, the Scanner observes day‑to‑day behavioural signals to build a realistic picture of what’s happening across the organisation: where trust is over‑relied on, where fatigue leads to shortcuts, and which habits are quietly forming.

Personalise

Personalise is where those signals are interpreted. Privci doesn’t treat everyone the same. Two people might take the same action for very different reasons — one driven by trust, another by time pressure. Without understanding that difference, any response will miss the mark. The Scanner observes these conditions across individuals, teams, and the wider organisation, using a behavioural model that considers capability, opportunity, and motivation.

Intervene

Intervene is where insight turns into action. Rather than delivering a static report, Privci deploys specialised intervention agents that provide the right support to the right people — whether that’s a convenience‑seeker, an anxious avoidant, or a behavioural norm shaping group behaviour. Interventions are context‑aware and behaviour‑specific, drawing on established behaviour‑change approaches. The same habit may appear across employees, but the response is tailored to the underlying cause — making intervention more effective and more sustainable.

Reassess

Reassess ensures the Scanner continues to improve over time. The system learns from every interaction — what changed behaviour, what didn’t, and where risk remains — refining its understanding with each cycle. Rather than relying on assumptions, the Scanner continuously adapts, strengthening insight and effectiveness from one scan to the next.

COM-B Behaviour Model

The intervention agents are grounded in the COM‑B model of behaviour change, enabling a clear understanding of each user’s Capability, Opportunity, and Motivation—the three essential components of sustainable behavioural change.

BEHAVIOUR
CAPABILITY
OPPORTUNITY
MOTIVATION

Capability

The psychological and physical ability to perform a secure behaviour. This reflects whether an individual has the knowledge, skills, and competence required to act safely when needed.

  • Psychological capability: knowledge, comprehension, decision‑making
  • Physical capability: practical skills, task execution
  • Training interventions to build skills
  • Just-in-time guidance at point of action

Opportunity

All the external factors that make secure behaviour possible or prompt it. This includes the environment, systems, and organisational structures that influence how employees act.

  • Social opportunity: norms, peer influence, cultural cues
  • Physical opportunity: resources, prompts, workflow triggers
  • Privacy enforcement mechanisms
  • Personal data management controls

Motivation

The internal processes that energise and direct behaviour — from deliberate choices to automatic habits. This determines what drives, reinforces, or undermines secure actions.

  • Reflective motivation: reasoning, evaluation, planning
  • Automatic motivation: habits, impulses, emotional responses
  • Incentives and rewards
  • Social comparison and competition
  • Behavioural nudges and reinforcement

Try the Interactive Demo

Experience Privci in action. Explore our interactive demos to see how behavioural intelligence transforms your organisation’s security posture.

See how Privci continuously analyses employee behaviour to deliver evidence‑based risk insights and personalised interventions.
Each scan reveals realistic compromise routes by modelling how behavioural weaknesses and environmental factors could lead to incidents.

Privci Engines

Our comprehensive platform combines five specialised engines to address the full spectrum of human risk, creating a continuous layered defence system.

Awareness Engine
Change Engine
Phish Aware
Business Watch
Policy Keeper

Awareness Engine

Multi-layered training experience designed for modern workforces with diverse needs and behavioural patterns.

Instead of relying on one‑size‑fits‑all annual training, Privci provides continuous, contextual, and adaptive learning across three core training streams.

Training Streams:

  • Baseline Training: Continuous foundation with real-time, gamified prompts at policy violation moments
  • CyberSkills Training: Trophy-driven curriculum with compliance-aligned modules and advanced threat-resilience topics
  • Policy Training: Gamified experience centred on the Policy Champion Award, transforming policies into immersive learning

ROI:

Meets mandatory training requirements, reduces repeat violations by 67%, cuts training costs by 45%, and strengthens security culture with measurable behavioural change.

Change Engine

Transforms behavioural data into targeted interventions using the COM‑B model for sustainable change.

While the Awareness Engine delivers training and behavioural data, the Change Engine transforms that data into targeted behavioural interventions addressing root causes of risky habits.

Core Components:

  • Direct Intervention: Ten specialised behavioural agents targeting specific risky habits
  • Security Chronicles: 49-day personalised storyline with real-world behaviours as in-game traits
  • Topic of the Week: Weekly, threat-focused micro-lesson with quizzes and real-world breach references
  • Behaviour Insights: Threat-focused dashboard analysing susceptibility to nine top end-user threats
  • Threat Insights: Visualises potential attack scenarios and likely attacker routes

Phish Aware

Dedicated phishing‑resilience module combining automated simulations with gamified skill‑building.

Phish Aware goes beyond traditional phishing campaigns by combining Phish Tests with the more advanced Phish Challenge, offering a deeper, more accurate assessment of user strengths and weaknesses.

Key Features:

  • Phish Direct: Automated simulations with 800+ templates and custom mode
  • Live Template Suggestions: Sourced from real breach reports and current threat intelligence
  • Supports direct phishing test whitelisting via Microsoft Direct Email Injection, Microsoft SMTP Relay, Google Workspace SMTP Relay, and native integration with Google Workspace and Microsoft Azure AD.
  • Phish Reporting: User‑friendly phishing reports with built‑in education, plus assisted investigation and response for administrators.
  • Phish Challenge: Gamified, inbox-style simulation with Gmail-style and Outlook-style interfaces
  • Leaderboard & Badges: Phish Master, Most Improved, Consistent Performer, Perfect Score
  • Department‑level Comparisons: Highlight team‑based strengths and weaknesses

Business Watch

Digital footprint analysis and real‑time enforcement to prevent data loss and monitor exposure.

Business Watch focuses on each user's digital footprint and online exposure, providing a critical assessment layer that feeds into both Behaviour Change Engine and the Human Vulnerability Scanner.

Core Capabilities:

  • Exposure Scan: Shadow Watch for Shadow IT risks and Breach Watch for monitoring compromised services
  • Data Guard: Real-time enforcement with 35 built-in alert use cases, data geofencing, and browser-based DLP
  • Dark Web Search: Continuous scanning for leaked corporate credentials and exposed emails
  • Monthly "lessons learned" summaries and breach cause insights
  • Domain public data breach monitoring for employee-used websites

Policy Keeper

Transform your internal security policies into actionable guidance and measurable compliance.

Privci's policy-driven design is rooted in a simple principle: help organisations reduce cost, effort, and administrative overhead by making the most of their internal security policies.

Key Features:

  • Policy-Aligned Training: Uses existing cybersecurity policies as foundation for employee training resources
  • 120+ Customisable Templates: For organisations without mature policy libraries
  • Cybersecurity Policy Builder: An advanced policy wizard for creating compliance‑ready security policies with ease.
  • User Acknowledgements: Enables users to review and acknowledge policies, with built‑in tracking and reporting.
  • Centralised Policy Hub: Upload, manage, and distribute security policies
  • Smart Q&A Tool: Built-in assistant for policy questions
  • Audit-Ready Evidence: For SOC 2, ISO 27001, GDPR compliance

Simple, Scalable Pricing

Behaviour‑Driven Human Risk Management for Every Organisation. Start with a free 30-day Human Vulnerability Scan.

Monthly Billing Annual Billing (Save 17%)

Foundation

$5 /user/month

Perfect for small teams beginning their human‑risk journey.

  • Human Vulnerability Scanner
  • Full Awareness Engine
  • Full Phish Aware
  • Change Engine (Behaviour Change, Behaviour Insights)
  • Google Workspace & Azure AD Integration
  • Policy Keeper (always free)
  • Business Watch
Start Free Trial
No credit card required. Cancel anytime.

Enterprise

Custom Pricing

For large organisations with advanced security, compliance, and integration needs.

  • Everything in Advanced, plus:
  • Unlimited Data Guard real‑time enforcement
  • Custom Geofencing & DLP rules
  • Custom Use Cases
  • Dedicated Customer Success Manager
  • Custom Reporting & SIEM Integration
  • Multi‑department Segmentation
  • On‑premise or Hybrid Deployment
Contact Sales