Phishing Simulation Score Calculator

Clicking a phishing link is a mistake, but no credentials or data have necessarily been exposed yet — submitting credentials on the fake page is the point where a simulated attack would have actually succeeded in a real incident. The resilience formula weights credential submissions three times as heavily as clicks to reflect that meaningfully greater severity, rather than treating every risky action as equally damaging.

A crude, obviously fake phishing email should fool far fewer people than a highly targeted, realistic spear-phishing attempt crafted to look like it came from a trusted colleague or vendor. Comparing your click rate against a benchmark that scales with difficulty avoids the misleading conclusion that your organization is unusually vulnerable just because you ran a more sophisticated (and appropriately harder) test.

A positive percentage means your click rate came in higher than the benchmark for that difficulty level, which generally does indicate more employees fell for the simulation than is typical — worth investigating further. But a single campaign's result can also be skewed by factors like timing, a particularly convincing pretext, or a smaller sample size, so one elevated result is a signal to watch rather than an automatic verdict on your security culture.

It's a deliberately simplified, illustrative estimate built from an average breach cost per credential and an assumed 10% probability that any given submission leads to a real breach, meant to translate an abstract click-rate statistic into a tangible number for budget discussions. Real breach costs and likelihoods vary enormously by industry, data sensitivity, and existing defenses, so treat this figure as a conversation-starter rather than a precise financial forecast.