Overview
This methodology calculates how likely users are to fall for phishing attacks based on their past clicking behavior. It looks at three time periods and weighs recent clicks much more heavily than old ones using mathematical formulas that prevent extreme scores.
Note: this methodology only includes phishing risk.
Time Periods and Weights
Recent (0-6 months): Base weight = 25 (highest impact)
Medium (6-12 months): Base weight = 18 (moderate impact)
Historical (12+ months): Base weight = 10 (minimal impact)
Phishing Risk Score Calculation
For each time period, the penalty is calculated using a square root function to provide diminishing returns:
Time Period Penalty = Base Weight × √(Click Count).
The raw score combines all penalties with a baseline of 1:
Raw User Cyber Risk Score = 1 + Recent Penalty + Medium Penalty + Historical Penalty
The raw score is then capped to a maximum of 100:
Capped Raw User Cyber Risk Score = MIN(Raw User Cyber Risk Score, 100).
The final score is normalized from the 1-100 scale to Verizon's 1.0-5.99 scale:
Final User Cyber Risk Score = 1 + ((Capped Raw User Cyber Risk Score - 1) / 99) × 4.99.
Organization-wide scoring averages all individual scores:
Organization Phishing Risk Score = Sum of All Individual Final User Cyber Risk Scores / Total Number of Users.
Example Calculation
User with 0 recent clicks, 1 medium click, and 1 historical click:
Recent penalty: 25 × √0 = 0
Medium penalty: 18 × √1 = 18
Historical penalty: 10 × √1 = 10
Raw User Cyber Risk Score: 1 + 0 + 18 + 10 = 29
Capped Raw User Cyber Risk Score: MIN(29, 100) = 29
Final User Cyber Risk Score: 1 + ((29-1)/99) × 4.99 = 2.41