---
title: "Phishing Risk Scoring Methodology"
slug: "phishing-risk-scoring-methodology"
updated: 2026-10-22T15:02:28Z
published: 2026-10-22T15:02:28Z
canonical: "docs.safe.security/phishing-risk-scoring-methodology"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Phishing Risk Scoring Methodology

## Overview

This system calculates how likely users are to fall for phishing attacks based on their past clicking behavior. It looks at three time periods and weighs recent clicks much more heavily than old ones using mathematical formulas that prevent extreme scores.

> **Note**: this methodology only includes phishing risk.

## Time Periods and Weights

- **Recent (0-6 months):** Base weight = 25 (highest impact)
- **Medium (6-12 months):** Base weight = 18 (moderate impact)
- **Historical (12+ months):** Base weight = 10 (minimal impact)

## Mathematical Formulas

For each time period, the penalty is calculated using a square root function to provide diminishing returns:

**Time Period Penalty = Base Weight × √(Click Count).**

The raw score combines all penalties with a baseline of 1:

**Raw User Risk Score** = 1 + Recent Penalty + Medium Penalty + Historical Penalty

The final score then applies a cap to a maximum of 100:

**Final User Risk Score** = MIN(Raw User Risk Score, 100).

Organization-wide user risk scoring averages all individual scores as follows:

**Organization Score** = Sum of All Individual Final Scores / Total Number of Users.

## Example Calculation

User with 0 recent clicks, 1 medium click, and 1 historical click:

- Recent penalty: 25 × √0 = 0
- Medium penalty: 18 × √1 = 18
- Historical penalty: 10 × √1 = 10
- Raw User Risk Score: 1 + 0 + 18 + 10 = 29
- Final User Risk Score: MIN(29, 100) = 29

## Risk Interpretation Scale

- **1-14: Excellent Risk Profile** - Very low phishing susceptibility
- **15-34: Good Risk Profile** - Low phishing risk
- **35-54: Moderate Risk Profile** - Average phishing risk
- **55-73: High Risk Profile** - Above average phishing risk
- **74-100: Critical Risk Profile** - High phishing risk requiring immediate attention

##