Which risk factors contribute to the user behavior risk score?

The user behavior risk score in CyberArk Defender Access is influenced by a variety of factors that can indicate potentially risky behavior or anomalies. Geolocation is a significant factor as it can signal unusual access patterns if logins are occurring from locations not typically associated with the user1. The AD joined status of a device is also a critical factor, as devices that are not part of the Active Directory may represent a higher risk when accessing resources2.

References:

CyberArk’s official documentation on configuring risk-based access control highlights the importance of location as a risk factor and describes how to adjust individual risk factor weights1.

The CyberArk Docs also detail how administrators can assign unique risk scores based on variables like geo-location data and the AD joined status of the device23.