Phishing States

This article describes the different risk states that users may fall into based on their interaction with phishing emails received. The states refer to users who have clicked or reported at least once the attack emails received.

• Weak User who tends to click frequently on phishing emails. On average, a user in this state interacts by clicking about 3 times on 5 received campaigns.

• Intermediate User who clicks on phishing emails with a moderate frequency, that is, at least 2 times on 5 received campaigns.

• Strong User who has clicked on a phishing email at least once in the past, but has subsequently significantly reduced the frequency of interaction, clicking less than once every 5 received campaigns.

• Cyber Defender User with a high level of cybersecurity awareness, who actively identifies phishing emails and uses the appropriate reporting function. To achieve this state, the user must have reported the last phishing campaign received without clicking on any phishing emails in the last five campaigns.
  (This data is only available when the reporting function has been implemented)

• N.A. User who has not received a phishing email in the last 5 campaigns or who does not have a phishing license. N.A. users have not interacted with the campaigns and do not have a defined status regarding risk classification.

It is important to note that in the CSV report, downloadable from the phishing statistics page, inactive users are also included (identifiable via the “active” column of the report with a value of 0), who are still classified as Strong User. For this reason, the numerical data in the CSV report may differ from those in the platform charts, which only consider active users.

The data in the platform charts (such as the click rate) consider only the last 12 completed campaigns. In the CSV report, however, all campaigns that have been completed over time are considered. To reconcile any discrepancies with the CSV report, it is necessary to manually filter only the last 12 campaigns exported in the CSV.

For a user who has received only one campaign, their state can only be “Weak” if they clicked or “Strong” if they did not click. The “Intermediate” state is relevant only after more campaigns with interactions.

If the user did not click but reported, they can be classified as a Cyber Defender.