Abstract: The subject disclosure relates to methods for assessing cyber-security risks, and in particular for calculating a risk-index for multiple users of a computer network. In some implementations, a process of the disclosed technology includes steps for determining a privileged index for each of a plurality of network users, determining a vulnerability index for each of the plurality of network users, calculating a threat score for one or more cyber-security attacks directed at each of the plurality of network users, and calculating a risk-index for at least one network user from among the plurality of network users, wherein the risk-index is based on the privileged index, the vulnerability index, and the threat score associated with each of the network users. Systems and machine-readable media are also provided.