diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py
index 0a1e764a50..510d27162f 100644
--- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py
+++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py
@@ -73,6 +73,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
 
             if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'):
                 for entity in self.security_content_obj.tags.observable:
+
                     risk_object = dict()
                     if entity['type'].lower() in risk_object_user_types:
                         risk_object['risk_object_type'] = 'user'
@@ -86,10 +87,9 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
                         risk_object['risk_score'] = self.security_content_obj.tags.risk_score
                         risk_objects.append(risk_object)
 
-                    elif 'Attacker' in (entity['role']):
+                    elif 'role' in entity and 'Attacker' in entity['role']:
                         risk_object['threat_object_field'] = entity['name']
                         risk_object['threat_object_type'] = entity['type'].lower()
-                        risk_object['risk_score'] = self.security_content_obj.tags.risk_score
                         risk_objects.append(risk_object) 
                     else:
                         risk_object['risk_object_type'] = 'other'