Creating a Phishing Risk Score for Employees

Phishing attacks remain one of the most prevalent cybersecurity threats to organizations, often exploiting human error. To effectively mitigate this risk, organizations need a way to evaluate employee vulnerability to phishing attacks and implement targeted interventions. One such method is the Factor-Based Weighting System, which calculates phishing risk scores for employees based on various weighted factors.

This blog post outlines how to create a phishing risk score using the Factor-Based Weighting System, including its advantages, how it works, and an example of its implementation.

Why Choose the Factor-Based Weighting System?

While there are several proven methods for calculating phishing risk scores, such as the Bayesian Risk Model and the Machine Learning Risk Model, we chose the Factor-Based Weighting System due to its simplicity, ease of implementation, and practicality for most organizations.

Here are some brief descriptions of the other methods and why the Factor-Based Weighting System stands out:

1. Bayesian Risk Model (Probabilistic Approach)

• Overview: The Bayesian Risk Model uses a probabilistic approach to assess the likelihood of an employee falling for phishing attacks. It factors in prior knowledge (such as role or past behavior) and updates the risk score based on observed behavior (e.g., clicking on phishing emails).
• Complexity: While the Bayesian model can provide more accurate risk predictions by incorporating conditional probabilities, it requires substantial historical data, advanced statistical understanding, and continuous updates to refine the model.
• Limitations: The Bayesian model is more data-intensive and requires a deeper understanding of probability theory, making it harder to implement without specialized resources.

2. Machine Learning Risk Model

• Overview: The Machine Learning Risk Model uses algorithms to predict phishing risk based on large sets of historical data and employee behavior. By training models on past phishing attempts and employee responses, the system can identify patterns and predict future risks.
• Complexity: This method requires significant data collection, training of algorithms, and continuous refinement. It also demands technical expertise in machine learning and data science.
• Limitations: Although highly accurate, it requires substantial computational resources and expertise, making it impractical for organizations without a dedicated data science team.

3. Factor-Based Weighting System (Chosen Approach)

• Overview: The Factor-Based Weighting System is the simplest and most practical approach for calculating phishing risk. It evaluates employees based on easily measurable factors such as their role, behavior in phishing simulations, training compliance, access to sensitive data, and region-specific risks. Each factor is given a weight based on its importance, and a composite score is calculated for each employee.
• Ease of Implementation: This method is quick to set up and doesn't require advanced statistical or machine learning skills. It uses readily available data, such as employee roles and simulation results, making it an accessible solution for most organizations.
• Why It Was Chosen: The Factor-Based Weighting System is easy to implement, flexible, and does not require large data sets or technical expertise. It also allows for customization based on organizational needs. Given these advantages, it is an ideal choice for organizations seeking a practical and scalable solution.

Factors to Include in the Phishing Risk Score

Several key factors are considered when calculating the phishing risk score. Each factor is assigned a weight based on its importance. The score for each factor is then multiplied by its weight to determine the overall risk score.

The picture above illustrates how a company's phishing risk score varies across different campaigns by industry, reflecting employee responses and reporting behaviors. By comparing these scores to the industry benchmark, it highlights areas where employee awareness can be improved to strengthen overall organizational security.

1. Employee Role & Privilege

Employees with access to sensitive data or critical systems are at a higher risk if compromised. For example, roles like IT admins or executives should receive a higher weight.

• Low Privilege: 10 points
• Medium Privilege: 20 points
• High Privilege: 30 points

2. Behavioral Data

This factor reflects an employee’s behavior in phishing simulations and real-life phishing attacks. Employees who consistently click on phishing links or fail simulations are at higher risk.

• Never clicked on phishing links: 10 points
• Clicked on 1 phishing link: 15 points
• Clicked on 2+ phishing links: 20 points

3. Training Compliance

Employees who complete security awareness training regularly are less likely to fall for phishing. Employees who have never completed training or failed tests will score higher risk.

• Completed and passed training: 10 points
• Completed but failed training: 20 points
• Never completed training: 30 points

4. Access to Sensitive Data

Employees who have access to sensitive data (such as financial data or customer information) pose a higher risk if compromised.

• No access: 10 points
• Limited access: 20 points
• Full access: 30 points

5. Regional & Compliance Risk

Certain regions may have more frequent phishing attempts, and employees in these regions may be at greater risk. Additionally, regions with more stringent data protection regulations (like GDPR) may need higher levels of security awareness.

• Low-risk region: 10 points
• Medium-risk region: 20 points
• High-risk region: 30 points

How the Factor-Based Weighting System Works

To calculate the phishing risk score for each employee:

1. Assign scores for each of the five factors based on their role, behavior in phishing simulations, training completion, access to sensitive data, and regional risk.
2. Multiply the score for each factor by its respective weight to determine its contribution to the total score.
3. Sum the weighted scores to obtain the employee’s total phishing risk score.
4. Categorize employees into risk levels (e.g., low, medium, high) based on their total score.

Example Phishing Risk Score Table

Here’s an example of how the Factor-Based Weighting System works for 10 employees:

Table 1: Phishing Risk Score Analysis: Measuring Employee Security Awareness

Conclusion

The Factor-Based Weighting System is the easiest to implement and most practical method for calculating phishing risk scores for employees. Unlike more complex models such as the Bayesian or Machine Learning models, it uses easily measurable data and can be set up quickly with minimal technical expertise. This makes it ideal for organizations of all sizes looking for a quick and efficient way to assess and mitigate phishing risks across their workforce.