MethodologyBy the PhishSheriff team · April 2025 · 8 min read

How We Calculate the Human Risk Score

The principles behind PhishSheriff’s per-person risk metric: which signals it uses, how severity and timing are weighted, why risk changes over time, and how to read the score responsibly.

Key points

Signals start with simulation outcomes and reporting behaviour
What happens after a click matters as much as the click
Risk is a current state that changes as behaviour changes
Read the score with its underlying activity, not on its own

On this page

Why a per-person score

Security awareness programmes have long reported one number, the organisational click rate, which hides important detail. A 12% click rate could mean risk is spread evenly, or that a specific group in accounts payable clicks almost every invoice-themed message. Those situations need very different responses, and an average cannot tell them apart.

The Human Risk Score summarises selected risk signals for each person so that follow-up can be targeted where it helps. It is a tool for prioritising support, not a judgement about an individual and not a prediction that a particular person will be breached. For the programme that produces these signals, see phishing training for employees.

The signals behind the score

Simulation outcomes are the core input: clicks, credential submissions, attachment opens, QR scans and responses to voice exercises, weighted by the difficulty of the scenario. Falling for a sophisticated, well-targeted message is treated differently from falling for an obvious one. Reporting behaviour sits alongside it: whether people report suspicious messages, and how quickly.

Depending on the deployment, other signals such as learning activity and role can also contribute. Role matters because consequence differs: a finance controller with payment authority carries more consequence per click than most colleagues. The signals available for your organisation, and how they are weighted, are part of the setup discussion with the PhishSheriff team.

What happens after the click

A click is not the whole story. Someone who clicks and immediately reports the message has shown the behaviour that helps contain a real incident, while someone who clicks and enters a password has not. Flat click-rate metrics treat these the same.

The score therefore looks at the sequence of actions, not just the click. Click plus credential entry is the most serious pattern; a click followed by a prompt report is treated more gently. This is also why programme owners should recognise reporting publicly: it is the most valuable behaviour the score reflects, and it can be learned. A click only counts if a person made it: our guide to phishing simulation false positives explains how security scanners can distort results.

Risk changes over time

An old mistake should not define someone who has since handled many exercises correctly and reported real suspicious messages. Recent behaviour carries more weight than older behaviour, so people can see their score improve as they improve.

This matters for fairness and for adoption. A metric that feels like a permanent record gets resented and gamed; one that visibly rewards improvement is easier to use. Improvement also needs to be maintained: without reinforcement, habits can fade.

From individuals to teams

Team and organisation views show where risk is concentrated: how much of the workforce sits in each band, how that is changing, and which departments or roles need attention. A team where several people with payment authority are high-risk deserves more attention than the same proportion in a team with little access to money or data.

Report the score alongside the activity behind it: scenario difficulty, participation, click rate and reporting rate. Together they explain progress more accurately than any single number. Human risk and email-domain trust are different measures and should be reported separately.