A unified risk score is only useful if everyone reading it agrees on what it represents. In Ombris it blends two signals that are usually reported separately: the technical posture of the identity layer and the measured behavior of the people in it.
The score moves when something an attacker could use changes. Remediating a high-weight Entra finding moves it. A department lowering its repeat-click rate moves it. Renaming a policy does not. That distinction is what makes the number defensible in a board conversation: every point maps to an action with an owner.