This article describes the different risk levels users may fall into based on their interaction with phishing emails sent to them.
Description of States
Weak
A user who frequently clicks on phishing emails. On average, a user in this state interacts by clicking at least 4 times on the last 5 campaigns received.
0.61<click_rate<=1
Intermediate
A user who clicks on phishing emails with moderate frequency, 2 or 3 times on the last 5 campaigns received.
0.21<click_rate<=0.61
Strong
A user who has clicked on a phishing email at least once in the past but has since significantly reduced their interaction frequency, clicking once or less on the last 5 campaigns received.
0<click_rate<=0.21
Cyber Defender
User with a high level of cybersecurity awareness, who actively identifies phishing emails and uses the reporting feature. To achieve this status, the user must have reported the last phishing campaign received without clicking on any phishing emails in the last five campaigns.
(This data is only available when the reporting feature has been implemented.)
N.A. User who has not received a phishing email in the last 5 campaigns or does not have the phishing license, thus does not have a risk classification.
State Assignment in the First Campaign
For a user who has received only one campaign, their status can only be “Weak” if they clicked or “Strong” if they did not click. The “Intermediate” status is only relevant after multiple campaigns with interactions.
If the user did not click but reported, they can be classified as a Cyber Defender.
CSV Report and Platform Charts
It's important to note that in the CSV report, downloadable within the Phishing statistics page, inactive users (identifiable by the “active” column in the report with a value of 0) are also included and are still classified as Strong User. For this reason, the numerical data in the CSV report may differ from the platform charts, which only consider active users.
Discrepancies in Click Rate Calculation between Platform and Report
The data in platform charts (like the click rate) consider only the last 12 completed campaigns. In the CSV report, however, all campaigns that have been completed over time are considered. To reconcile any discrepancies with the CSV report, you need to manually filter only the last 12 campaigns exported in the CSV.