Overview
This system calculates how likely users are to fall for phishing attacks based on their past clicking behavior. It looks at three time periods and weighs recent clicks much more heavily than old ones using mathematical formulas that prevent extreme scores.
Note: this methodology only includes phishing risk.
Time Periods and Weights
Recent (0-6 months): Base weight = 25 (highest impact)
Medium (6-12 months): Base weight = 18 (moderate impact)
Historical (12+ months): Base weight = 10 (minimal impact)
Mathematical Formulas
For each time period, the penalty is calculated using a square root function to provide diminishing returns:
Time Period Penalty = Base Weight × √(Click Count).
The raw score combines all penalties with a baseline of 1:
Raw User Risk Score = 1 + Recent Penalty + Medium Penalty + Historical Penalty
The final score then applies a cap to a maximum of 100:
Final User Risk Score = MIN(Raw User Risk Score, 100).
Organization-wide user risk scoring averages all individual scores as follows:
Organization Score = Sum of All Individual Final Scores / Total Number of Users.
Example Calculation
User with 0 recent clicks, 1 medium click, and 1 historical click:
Recent penalty: 25 × √0 = 0
Medium penalty: 18 × √1 = 18
Historical penalty: 10 × √1 = 10
Raw User Risk Score: 1 + 0 + 18 + 10 = 29
Final User Risk Score: MIN(29, 100) = 29
Risk Interpretation Scale
1-14: Excellent Risk Profile - Very low phishing susceptibility
15-34: Good Risk Profile - Low phishing risk
35-54: Moderate Risk Profile - Average phishing risk
55-73: High Risk Profile - Above average phishing risk
74-100: Critical Risk Profile - High phishing risk requiring immediate attention