How does Breeze RMM score user risk?

Security → User Risk scores every user in the selected client's organization from 0 to 100, four times a day. Each driver (failed or denied actions, missing MFA, unusual sign-in locations, recent evidence and others) is scored out of 100 and weighted into the total, and the list shows users at 50 or above. Click a user to see Top drivers and Recent evidence.

Can Breeze RMM find credit card numbers or SSNs on client computers?

Yes. Security → Sensitive Data runs scans from a scan policy, which can be partner-wide. The agent reads text files in user folders (CSV exports, .txt, scripts, notes) and matches patterns such as card numbers, SSNs, financial references and credentials; it does not open Excel, PDF or Word files. Findings show the file path, pattern and confidence, never the matched value.

What can I do with a sensitive data finding?

Accept it, mark it FP (false positive) so it stops counting as open, or select findings and click Remediate. Quarantine and delete ask for confirmation, then Breeze queues one command per file; quarantine moves the file to a quarantine folder on the device, and the finding changes to remediated when the agent reports back.

Can Breeze RMM assign security training to risky users?

Training is assigned through the Breeze API today, not from a button on the User Risk page. Each assignment is logged as evidence on the user with a -5 impact, and the Training completion card shows how many assigned users finish.

How to Find Risky Users and Sensitive Files on Client PCs

Name: How to Find Risky Users and Sensitive Files on Client PCs | Breeze RMM
Uploaded: 2026-10-22
Duration: 4 min 1 s
Description: Breeze RMM scores every user at a client from 0 to 100 and shows the evidence behind the number, and its agent scans user folders for card numbers, personal data and credentials, reporting where the data sits without ever sending the data itself.

Breeze RMM scores every user at a client from 0 to 100 and shows the evidence behind the number, and its agent scans user folders for card numbers, personal data and credentials, reporting where the data sits without ever sending the data itself.

4:01 Captions: English Open on YouTube

What's in the demo

Security → User Risk for Northfield CPA Group: the At-risk users list (50 and above) with Kevin Holt 72, Renee Dalton 56 and Elliot Park 52, recalculated four times a day
Kevin's Top drivers, each scored out of 100: Auth Failure Risk 100, Recent Impact Risk 100, Mfa Risk 90 (no MFA on the account), Session Anomaly Risk 72, Software Violation Risk 68
Recent evidence: "4 privilege elevation requests in the last 24 hours" (+28 impact) and "Cloudflare Access login from new country BR" (+17 impact)
True positive: the label is saved, the Labels count goes up by one, and Precision tracks how often the score was right for this client
Renee Dalton's evidence includes "Security training assigned: Shared client files from a personal email account" at -5 impact, and the Training completion card
Security → Sensitive Data → Policies: "Nightly client data sweep", badged Partner-wide, detection classes pii, pci, financial and credential, on a nightly schedule
The Dashboard: Total Findings 11, Critical Open 5, Remediated (24h) 1, Open Findings 9, split by data type (PII 5, credential 2, PCI 2, financial 2)
Findings filtered to critical: five rows of file path, type, pattern, confidence, device and status, with no matched values. The card file in Kevin Holt's Desktop folder matched pci_card_number at 97%
A text file of payment-processor test card numbers marked FP: its status changes to False Positive
The card file and a payroll export on NCG-SRV-01 selected, Remediate (2) → Quarantine → confirm: "Remediation initiated successfully", 2 command(s) queued

Questions this video answers

How does Breeze RMM score user risk?: Security → User Risk scores every user in the selected client's organization from 0 to 100, four times a day. Each driver (failed or denied actions, missing MFA, unusual sign-in locations, recent evidence and others) is scored out of 100 and weighted into the total, and the list shows users at 50 or above. Click a user to see Top drivers and Recent evidence.
Can Breeze RMM find credit card numbers or SSNs on client computers?: Yes. Security → Sensitive Data runs scans from a scan policy, which can be partner-wide. The agent reads text files in user folders (CSV exports, .txt, scripts, notes) and matches patterns such as card numbers, SSNs, financial references and credentials; it does not open Excel, PDF or Word files. Findings show the file path, pattern and confidence, never the matched value.
What can I do with a sensitive data finding?: Accept it, mark it FP (false positive) so it stops counting as open, or select findings and click Remediate. Quarantine and delete ask for confirmation, then Breeze queues one command per file; quarantine moves the file to a quarantine folder on the device, and the finding changes to remediated when the agent reports back.
Can Breeze RMM assign security training to risky users?: Training is assigned through the Breeze API today, not from a button on the User Risk page. Each assignment is logged as evidence on the user with a -5 impact, and the Training completion card shows how many assigned users finish.

A note on the demo: the users, scores, evidence and findings are seeded demo data, and no real card numbers or personal data exist anywhere in it. In this build the Sensitive Data pages show findings for every client you manage even with one client selected; here they all belong to Northfield. The two quarantined findings still read Open at the end because they change only when the agent reports back.

Do this on your own fleet

Everything in the video is in the product you get. Start the Cloud Beta in minutes, or self-host the open-source Community edition for free.

Start Cloud Beta Deploy for Free Book a Demo