URL Category Data for Human Risk Management Platforms
Human risk platforms promise to show where people create security risk and to coach them in the moment. Much of that risk shows up as a click, a visit or an upload to a website.
This guide explains where URL category data plugs into a security awareness or human risk product, which categories carry real meaning, and how to keep the data current inside your platform.
Team risk profile: Finance
Events this week, labelled by categoryWhere URL category data plugs into a human risk platform
A human risk platform sees many events that end in a domain: a link in a reported email, a browser visit from an endpoint agent, a proxy log, a file upload. A category turns each domain into a meaningful label your rules, models and coaching content can act on.
Risky browsing signals
Visits to phishing, parked, newly registered or anonymizer sites become labelled behaviour events instead of raw URLs.
Phishing simulation context
Categories show which site types real lures imitate, so simulations match what people actually face.
Reported message triage
When users report a message, the categories of its links help sort real threats from harmless newsletters.
Just-in-time nudges
A short tip that appears when someone opens a file host or a new AI tool lands better than a yearly course.
Training assignment
Someone who often lands on URL shorteners and parked pages gets the link safety module, not the generic one.
Risk scoring
Category weighted events feed a score per person, team or office, alongside simulation and reporting results.
AI tool use
First use of an unapproved AI service can trigger the AI acceptable use module and a policy reminder.
Board reporting
Trends by category, such as fewer visits to risky sites after a campaign, show the effect of the programme.
From raw click to coaching moment
Most human risk products follow the same path from an event to an action. Category data sits in the second step, and everything after it depends on the label being right and current.
What the label gives you
- A primary category and secondary categories, ranked by how much of the site they describe
- A clear flag for parked and for-sale domains
- Security categories such as Malware / Phishing / Suspicious
- The IAB Content Taxonomy in the same file for finer content labels
- A stable vocabulary for rules and reports, so "File Hosting" means the same thing for every customer
What your platform adds
- Who, when and from which device, under your privacy rules
- Domain registration age and your own threat intelligence
- Whether the event came from a simulation or real traffic
- The customer's approved tools list and policies
- The coaching content and tone that suits each audience
Which categories matter for human risk
Of the 59 web filtering categories, a small group carries clear human risk meaning. Others help reduce noise or shape training content; full definitions are on the category list.
| Category | What it says about behaviour | Typical use |
|---|---|---|
| Malware / Phishing / Suspicious | The person reached a known bad site. Whether it was blocked or not, it is the strongest single signal. | ScoreNudgeTraining |
| Parked / For-Sale Domains | Links to parked domains rarely appear in normal work and often come from lures or typos. | ScoreTraining |
| URL Shorteners | Frequent clicks on hidden destinations point to a link safety habit worth coaching. | Training |
| Cloud Storage / File Hosting | Uploads to personal file hosts are a classic data handling risk. Downloads from them are a common lure path. | NudgeScore |
| AI / LLM Tools | Use of unapproved AI services may expose company data. First use is a good coaching moment. | NudgeTraining |
| VPN / Proxy / Anonymizers | Attempts to route around company controls, sometimes innocent, sometimes not. | ScoreNudge |
| Remote Access Tools | A key step in support scams. An unexpected visit deserves a fast warning. | NudgeScore |
| File Sharing/P2P | Pirated software and media often carry malware and licence risk. | TrainingScore |
| Online Banking, Financial Services | Legitimate sites, but the most imitated in lures. Useful as simulation themes and for spotting lookalikes. | Simulation themes |
| Business, News/Media, Government & Legal | Normal work traffic. Lowers noise so analysts look at events that matter. | Noise reduction |
Phishing simulation context
Phishing simulations teach best when they look like the threats people really see. Category data helps on two sides: choosing believable themes, and making sure your own simulation domains behave as planned in customer networks.
Realistic themes
- Group lure themes by the category of the site they imitate: banking, file hosting, delivery and travel, social networking, web-based applications
- Match the mix to each customer's sector, so a hospital sees different themes than a retailer
- Use the share of real reported links per category to balance a quarterly campaign
- Retire themes that no longer reflect what users report
- Keep landing pages on your own domains, never on lookalikes of real brands
Simulation domain health
- Check how your simulation domains are categorized in category data used by filters
- Expect some filters to label them as phishing, which is correct behaviour
- Give customers a clean list of simulation domains to allow in their filters and mail gateways
- Rotate domains and recheck their categories before each campaign
- Treat a click from a filtered network that never reached the page as "blocked", not "safe"
A category weighted risk score
Most platforms build a score from weighted events over a rolling window. The list below shows one sensible starting point; weights are illustrative and each product should tune its own with customer feedback.
- Reached a site in Malware / Phishing / Suspicious+10
- Entered details on a simulation landing page+9
- Visited a Remote Access Tools site after an unknown call or message+7
- Uploaded a file to personal Cloud Storage / File Hosting+6
- Clicked a link to a parked or very new domain+5
- Used an unapproved AI / LLM tool for the first time+4
- Visited a VPN / Proxy / Anonymizers site+3
- Reported a real or simulated phishing message-6
- Completed the matching training module-4
Delivery options: files, API and real-time lookup
Human risk platforms process large event volumes in batches and a smaller number of events in real time. The data comes in forms that suit both, and most platforms combine them; file formats are described on the web filtering database page.
Downloadable database
CSV, Parquet or JSON loaded into your data warehouse or event pipeline.
- Join millions of browsing events to categories in one query
- No per-event calls and no employee data leaves your platform
- Runs on-premise or air-gapped for sensitive customers
- Daily delta files keep it current
Lookup API
Included with licences, called from your services for single or batch domains.
- Covers domains your local copy does not hold
- Good for reported message triage and analyst tools
- Send domains only, never full URLs or user details
- See the API documentation
Local index plus API
A compact index in your browser agent or nudge service, with the API for misses.
- Nudges appear within moments of a visit
- Full file in the warehouse for scoring and reports
- One update job feeds both copies
- Fallback rule when a domain is unknown
Freshness: why the daily stream matters
Phishing domains are often used within days of registration and then dropped. A risk platform that labels events with month-old data misses the clicks that matter most, so plan the daily job first; more detail is in how new sites get classified.
About 300,000 newly registered domains are categorized and delivered as delta files.
New domains are checked again, because many add content after launch.
A second recheck catches slower changes in purpose.
All other domains are refreshed, so long-lived sites stay accurate.
Examples from human risk products
These scenarios show how category data changes what a platform can do. Each one uses only the domain category plus signals the platform already has.
The invoice that was not
A user reports a message. Link categories mark it as a real threat within seconds, the user gets a thank-you, and every other recipient gets a targeted nudge.
A team that loves file hosts
One department keeps sharing files through personal file hosts. The platform assigns the data handling module to that team only and shows the trend to its manager.
Shadow AI first use
The first visit to an unapproved AI chatbot triggers a short note on what data may be pasted into AI tools and a link to the approved ones.
The support call scam
A visit to a remote access download page outside normal IT work raises a warning and an alert to the help desk before any session starts.
Integration steps for a human risk platform
These steps take category data from a licensed file into labelled events, scores and nudges. Most teams ship the labelling and reporting first, then add real-time nudges.
Map event sources
List every connector that yields a domain: mail reports, browser agents, proxy logs, cloud app logs.
Normalize domains
Reduce each URL to host and registered domain, and expand known shorteners where you can.
Load the database
Import the file into your warehouse, keyed by domain with ranked categories and the IAB labels.
Choose meaningful categories
Pick the small set with human risk meaning and agree weights with your content and privacy teams.
Label and score
Join events to categories, add your own signals and compute the rolling score.
Connect coaching
Map each risky category to a nudge text and a training module in your library.
Run daily deltas
Apply delta files and re-label recent events whose domains changed category.
Explain every action
Show the category in nudges and admin views, so people understand why they got a message.
Good practice and pitfalls
Human risk programmes rely on trust. The way category data is used decides whether employees see the platform as help or as surveillance.
Do
- Score only categories with a clear security meaning
- Report trends at team level by default
- Credit good behaviour such as reporting
- Keep a human review before any HR action
- Show the reason for each nudge in plain words
Avoid
- Scoring people on lifestyle categories
- Treating one visit as proof of wrongdoing
- Labelling events with stale data
- Sending full URLs with user identity to outside services
- Nudging so often that people stop reading
What to check before licensing category data
These questions help a product team compare category data for a human risk platform. Licence terms for embedding are on the OEM licensing page.
Coverage
120 million categorized domains, with the 20 million most visited covering 99.99% of web traffic and usage.
Security categories
Phishing, parked, shortener and anonymizer labels that match how people get caught.
New domain speed
Daily categorization of newly registered domains with rechecks.
AI tool depth
A dedicated AI tools set rather than a single broad AI label.
Local use
Files that run inside your platform, so event data stays with you.
Measured accuracy
Regular manual validations, with reports available to licence holders.
Human risk management FAQ
What is URL category data used for in a human risk management platform?
It turns raw browsing and click events into behaviour signals. A visit to a phishing site, a click on a new domain or an upload to personal file hosting becomes a labelled event that can drive a nudge, training or a score change.
Does the category database collect any data about employees?
No, the database is a list of domains and categories that runs inside your own platform. Your product decides which events it collects under its own privacy terms.
How does category data help phishing simulations?
It shows which site types real lures imitate, so templates can mirror banking, cloud storage, delivery or social network themes. It also lets you check how your own simulation domains are categorized, so you can plan allowlisting with customers.
Which categories matter most for human risk scoring?
Malware / Phishing / Suspicious, Parked / For-Sale Domains, URL Shorteners, Cloud Storage / File Hosting, AI / LLM Tools, VPN / Proxy / Anonymizers, Remote Access Tools and File Sharing/P2P. Business, News/Media and Government & Legal help lower noise.
Should we use the API or the downloadable database?
Most platforms use both. The file runs inside your analytics pipeline for bulk scoring, and the lookup API included with the licence covers domains your local copy does not yet hold.
How fresh is the data?
About 300,000 newly registered domains are categorized every day and delivered as daily delta files. Each is checked again after a week and after a month, and all other domains are refreshed monthly.
Can category data track AI tool use for training purposes?
Yes. The AI tools set covers 11,800+ AI-tool domains in 18 categories and 165 subcategories, which lets a platform spot first use of an unapproved AI tool and assign the right policy module.
Which licence fits a security awareness vendor?
An OEM licence, because the data runs inside a product you sell. Group-wide licences cover vendors with several products, and resale or publication of the raw data is not allowed.
Is a category visit proof that an employee did something wrong?
No, a category is context about a site, not a verdict about a person. Use categories to pick helpful coaching and spot trends, and keep a human review step before anything affects an employee record.
Give every risky click a clear label
Tell us how your platform collects events, how many customers you serve and where the data must run. We will suggest the data layout and licence that fit.
License the database OEM licensing