Phish-Prone Rate

Phish-prone rate is calculated by dividing the number of employees who fail a given simulated phishing campaign by the total number who received it, expressed as a percentage. Failure is usually defined by the action taken, such as clicking a link, versus more severe actions like submitting credentials on a spoofed login page, so many organizations track multiple tiers of failure rather than a single number. Comparing phish-prone rate across departments, seniority levels, or attack types often reveals where targeted training investment will have the greatest impact.

This metric matters because it gives security leaders a concrete, trackable number to report to executives and boards, turning an abstract concern about human risk into a measurable trend that can justify training investment. A declining phish-prone rate over successive simulation campaigns is generally interpreted as evidence that awareness training and simulation are working, while a rising rate can flag emerging risks, such as new hires or increasingly sophisticated attack templates. Regulators and compliance frameworks in sectors like banking increasingly expect organizations to track and report on this kind of behavioral metric alongside technical controls.

Phish-prone rate should be interpreted carefully rather than used punitively, since fear of being publicly named for a failed simulation can discourage employees from reporting real phishing attempts. The metric is most useful when read alongside reporting rate, the percentage of employees who correctly identify and report a phishing attempt, since a low phish-prone rate combined with a low reporting rate may simply mean employees are unengaged rather than fully protected. Benchmarking against industry averages provides useful context, but the most meaningful comparison is an organization's own trend over time.