This article describes the different risk statuses that users can fall into, based on their interaction with phishing emails sent to them.
Description of Statuses
Weak
A user who tends to click on phishing emails very frequently. On average, a user in this status clicks on at least 4 out of the last 5 campaigns received.
0.61<click_rate<=1
Intermediate
A user who clicks on phishing emails at a moderate rate, 2 or 3 times out of the last 5 campaigns received.
0.21<click_rate<=0.61
Strong
A user who has never clicked on a phishing email or has clicked very rarely, specifically once or less out of the last 5 campaigns received.
0<click_rate<=0.21
Cyber Defender
A user with a high level of cybersecurity awareness, who actively identifies phishing emails and uses the reporting feature. To achieve this status, the user must have reported the last phishing campaign received without clicking on any phishing emails in the last five campaigns.
(This data is only available when the reporting feature has been implemented.)
N.A. A user who has not received a phishing email in the last 5 campaigns or does not have a phishing license, so they do not have a risk classification.
Assigning Statuses in the First Campaign
For a user who has received only one campaign, their status can only be “Weak” if they clicked or “Strong” if they did not click. The “Intermediate” status is only relevant after multiple campaigns with interactions.
If the user did not click but reported, they can be classified as a Cyber Defender.
CSV Report and Platform Charts
It’s important to note that in the CSV report, downloadable from the Phishing statistics page, inactive users are also included (identifiable by the “active” column in the report with a value of 0), and they are still classified as Strong User. For this reason, the numerical data in the CSV report may differ from the data in the platform charts, which only consider active users.
One thing to keep in mind regarding reports is the data related to a user’s classification: when referring to a regular campaign, this status is calculated based on the user’s behavior in the last 5 regular campaigns; on the other hand, if you look at the status related to a remediation, this is tied exclusively to that remediation and does not match what you see in the dashboard (where the status is based on regular campaigns).
Discrepancies in Click Rate Calculation Between Platform and Report
The data in the platform charts (such as click rate) only consider the last 12 completed campaigns. In the CSV report, however, all campaigns completed over time are included. To reconcile any discrepancies with the CSV report, you need to manually filter only the last 12 campaigns exported in the CSV.