Employee Phishing Risk Score: How to Build One in 2026
Learn how to build an employee phishing risk score from simulation data in 2026 - weighting, tiers, and training routing that actually reduces risk.
DefendWise
DefendWise
Phishing simulation platforms hand you click rates, report rates, and time-to-click by the campaign. Turning that pile of numbers into a single employee phishing risk score is what makes the data usable for training assignments, cyber insurance evidence, and board reporting in 2026.
TL;DR
- An employee phishing risk score should combine click rate, report rate, time-to-click, and repeat-offense history into one 0-100 number.
- Weight click behavior at roughly 40% and reporting behavior at 20-25% so the score rewards good habits, not just punishes bad ones.
- Recalculate scores on a rolling 90-day window so one bad campaign doesn't permanently brand an employee high-risk.
- Segment the workforce into four tiers - low, medium, high, critical - and route each tier into a different training cadence.
- Buy: use a platform with per-user tracking already built in rather than building the pipeline in a spreadsheet.
Why this matters
A click rate tells you what happened in one campaign. An employee phishing risk score tells you who's actually dangerous to the organization over time, which is a different question entirely.
MSPs managing dozens of subclients need this distinction because a single aggregate click rate hides the 8-12% of users who click on almost everything and the users who clicked once, three months ago, and never again. Cyber insurers are starting to ask for evidence of risk-based training targeting, not just proof that a phishing simulation ran. A scoring model gives you both the internal prioritization tool and the external compliance artifact in one build.
Without a score, every employee gets the same training cadence regardless of actual risk. That's how you burn training minutes on people who don't need it while your highest-risk users - often in finance, HR, and executive assistant roles - get the same monthly module as everyone else.
What you'll need
- Phishing simulation data covering at least three consecutive campaigns, ideally a 90-day rolling window
- Per-user click, report, and time-to-click data (not just department or org-wide averages)
- A defined weighting model before you run the first calculation, not after you see the results
- A platform or spreadsheet capable of recalculating scores automatically as new campaign data comes in
- Job role or department metadata so you can flag high-value targets (finance, HR, executives) separately from general staff
If your current simulation tool only reports aggregate click rates and doesn't expose per-user history, you're working with the wrong data source before you even start. How to benchmark employee phishing susceptibility rates covers what a usable baseline dataset looks like before you try to build a score on top of it.
The steps
1. Pull raw simulation data across a 90-day window
A single campaign is a snapshot, not a pattern. Pull click events, report events, and time-to-click timestamps for every employee across at least three campaigns spanning 90 days.
This window is long enough to smooth out one anomalous campaign (an unusually convincing template, a Monday-morning send that catches people off guard) but short enough that the score still reflects current behavior in 2026, not habits from a year ago.
Common mistake: pulling data from a single quarter's campaign and calling it a risk score. One data point is a click rate, not a score.
2. Define the risk variables
Four variables carry the real signal: click rate (did they click the link), report rate (did they report the simulation instead), time-to-click (how fast they clicked, which correlates with impulsivity), and repeat-offense count (how many separate campaigns they've clicked on).
Credential entry - actually typing a password into a simulated landing page - deserves its own flag. An employee who clicks a link but stops before entering credentials is a meaningfully lower risk than one who submits data on every simulation that reaches their inbox.
3. Weight each variable by real-world impact
Not every behavior deserves equal weight. A workable starting model: click rate at 40%, credential entry at 25%, report rate as a negative modifier at -20% (good reporting behavior should lower the score), and repeat-offense count as a multiplier that increases the base score by 1.5x after a second click within the window.
This weighting matters because a raw click-rate average punishes someone who clicked once and immediately reported the follow-up simulation the same way it punishes someone who's clicked five times running. Those are not the same risk profile, and the score should say so.
4. Calculate a composite score per employee
Normalize each variable to a 0-100 scale, apply the weights from step three, and sum them into a single composite score. An employee with a 60% click rate, no reports, and two repeat offenses in 90 days should land in the 70-85 range. An employee with a single click, immediate reporting on the next two campaigns, and no credential entry should land under 20.
Common mistake: scoring on click rate alone. Two employees with identical 30% click rates can have wildly different risk profiles if one always reports the follow-up email and the other never does.
5. Segment scores into risk tiers
Four tiers keep the model actionable without over-engineering it: low (0-24), medium (25-49), high (50-74), critical (75-100). Critical-tier employees - typically the 5-10% of any workforce who account for a disproportionate share of clicks - are the ones who need immediate, targeted intervention, not another generic monthly module.
How to segment phishing simulations by department risk level breaks down how to layer department context (finance and HR get simulated invoice fraud and payroll scams; engineering gets fake software update prompts) on top of the individual score.
6. Map risk tiers to training assignments
Low-tier employees get standard cadence. Medium-tier gets an extra targeted module on the specific scam type they fell for. High and critical tiers get immediate remedial training triggered automatically at the moment of the click, not queued for the next scheduled session.
The point of the score is routing, not just labeling. A score that sits in a dashboard and never changes anyone's training assignment isn't earning its build cost.
7. Build the trend line
A single score is a snapshot. Track each employee's score across rolling windows so you can see whether targeted training is actually moving the needle or whether the same names show up in the critical tier every quarter.
How to reduce phishing click rates across your organization covers the intervention side once the trend line tells you where the problem is concentrated.
8. Report scores to leadership without shaming
Aggregate the individual scores into department-level and org-wide summaries before this data reaches leadership or a client's compliance file. Naming individual employees in a leadership report creates a liability and morale problem that outweighs the diagnostic value.
Automate risk scoring across every client
Unlimited seats, one flat fee - built for MSPs running phishing simulations at scale.
Troubleshooting
- One bad campaign spikes scores org-wide. Check whether the campaign template was unusually convincing (a fake DocuSign or MFA prompt tends to outperform generic templates). Weight recent campaigns against the 90-day average instead of the most recent one alone.
- Employees game the score by reporting everything, including real emails. Add a false-positive check - if report volume triples without a corresponding drop in click rate, the reporting behavior is reflexive, not genuine.
- Small departments produce unstable scores. A five-person team where one person clicks shows a 20% department click rate that looks alarming but isn't statistically meaningful. Score individuals, not thin department averages.
- Executive and finance scores look artificially high. These roles get targeted with more sophisticated spear-phishing templates by design, which naturally raises click probability. Compare against a peer group running the same difficulty tier, not the general workforce baseline.
- No baseline exists before the first real campaign. Run one unweighted, ungraded simulation first purely to establish a starting point before the score has any consequence attached to it.
- Vendor default scoring doesn't match your risk model. Most platforms ship a generic click-rate score out of the box. If it doesn't separate report behavior and repeat offenses, you're not looking at a real risk score, you're looking at a percentage with a different label.
Tools and resources
- Per-user simulation data with click, report, and time-to-click timestamps
- How to test employees against spear-phishing and BEC for building the harder campaign templates that stress-test high-tier scores
- How to communicate phishing simulation results to leadership for the reporting layer once scores exist
- A weighting spreadsheet template or a platform that calculates composite scores natively per user, not just per campaign
What to do next
Once the score model runs on a rolling basis, the next problem is presenting it to leadership or to an MSP client without turning the conversation into a blame session. That reporting layer is where most scoring programs actually fail in year one - not the math, the delivery.
FAQ
What's a good employee phishing risk score?
A score under 25 on a 0-100 scale is considered low risk in most models. Anything above 50 warrants immediate targeted training rather than waiting for the next scheduled campaign.
How is an employee phishing risk score calculated?
It's a weighted composite of click rate, credential entry, report rate, and repeat-offense count, typically calculated over a rolling 90-day window rather than a single campaign.
Should phishing risk scores affect performance reviews?
Most security teams keep individual scores out of formal performance reviews and use them only to route training. Tying scores to reviews increases gaming behavior like reflexive reporting.
How often should risk scores be recalculated?
Recalculate on a rolling basis after every campaign, using a 90-day trailing window so a single anomalous result doesn't permanently inflate the score.
What's the difference between click rate and a phishing risk score?
Click rate is one input among several. A risk score also accounts for reporting behavior, time-to-click, and repeat offenses, so two employees with the same click rate can land in different risk tiers.
Can a phishing risk score predict a real breach?
It predicts susceptibility, not certainty - a high score identifies who is statistically more likely to fall for a real attack, which is why high-tier employees get prioritized remedial training.
Do risk scores work across MSP subclients with different tenants?
Yes, as long as the scoring model normalizes per-tenant baselines rather than comparing every subclient against one universal average, since industries and job-role mixes vary by client.
Does reporting a phishing email lower an employee's risk score?
It should. A weighting model that treats reporting as a negative modifier rewards the behavior you actually want to reinforce, not just penalize clicks.
One last thing
The employees who never click anything aren't automatically low risk - some are just under-tested because they're not on the finance or HR distribution lists that get the harder spear-phishing templates. Before trusting a 2026 risk score roster, check whether every employee has actually been exposed to a comparable difficulty tier. A perfect score built on easy templates isn't a low-risk employee, it's an untested one.