The risk factors that contribute to the user behavior risk score are geolocation and session cookie. Geolocation can indicate an unusual or risky location from which a user is attempting to access a system, which helps in identifying potential security threats. Session cookies can be used to determine if a session is being hijacked or misused. The operating system, device certificate, and AD joined status of the device are important for other security aspects but are less directly indicative of user behavior risk scoring.