Phishing Risk Assessment Calculator

ANA›Life Services Authority›National Calculator Authority›Phishing Risk Assessment Calculator

.calc-container { max-width: 640px; margin: 2rem 0; padding: 1.5rem; background: #fff; border: 1px solid #ddd; border-radius: 8px; box-shadow: 0 1px 3px rgba(0,0,0,0.06); font-family: system-ui, -apple-system, sans-serif; } .calc-container h3 { font-family: Georgia, serif; font-size: 1.15rem; color: #1a1a1a; margin-bottom: 1rem; padding-bottom: 0.5rem; border-bottom: 2px solid var(--ac, #3d5a80); } .calc-row { display: flex; align-items: center; gap: 0.75rem; margin-bottom: 0.75rem; flex-wrap: wrap; } .calc-row label { min-width: 160px; font-size: 0.9rem; color: #333; font-weight: 500; } .calc-row input[type="number"], .calc-row select { flex: 1; min-width: 120px; max-width: 200px; padding: 0.5rem 0.6rem; border: 1px solid #ccc; border-radius: 4px; font-size: 0.9rem; font-family: system-ui, sans-serif; color: #1a1a1a; background: #fafaf8; } .calc-row input:focus, .calc-row select:focus { outline: none; border-color: var(--ac, #3d5a80); box-shadow: 0 0 0 2px rgba(26,74,138,0.12); } .calc-row .unit { font-size: 0.82rem; color: #888; min-width: 30px; } .calc-btn { display: inline-block; margin-top: 0.5rem; padding: 0.55rem 1.5rem; background: var(--ac, #3d5a80); color: #fff; border: none; border-radius: 4px; font-size: 0.9rem; font-weight: 600; cursor: pointer; font-family: system-ui, sans-serif; } .calc-btn:hover { opacity: 0.9; } .calc-result { margin-top: 1.25rem; padding: 1rem 1.25rem; background: #f0f6fc; border-left: 3px solid var(--ac, #3d5a80); border-radius: 0 6px 6px 0; display: none; } .calc-result.visible { display: block; } .calc-result-label { font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.06em; color: #666; margin-bottom: 0.25rem; } .calc-result-value { font-size: 1.6rem; font-weight: 700; color: var(--ac, #3d5a80); } .calc-result-detail { font-size: 0.85rem; color: #555; margin-top: 0.5rem; line-height: 1.5; } .calc-note { margin-top: 1rem; font-size: 0.8rem; color: #888; font-style: italic; } .calc-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 0.75rem; margin-top: 0.75rem; } .calc-grid-item { padding: 0.6rem 0.8rem; background: #f8f9fa; border-radius: 4px; border: 1px solid #eee; } .calc-grid-item .label { font-size: 0.75rem; color: #888; text-transform: uppercase; letter-spacing: 0.04em; } .calc-grid-item .value { font-size: 1.1rem; font-weight: 600; color: #1a1a1a; } @media (max-width: 720px) { .calc-row { flex-direction: column; align-items: flex-start; gap: 0.3rem; } .calc-row label { min-width: auto; } .calc-row input[type="number"], .calc-row select { max-width: 100%; width: 100%; } .calc-grid { grid-template-columns: 1fr; } } .calc-chart { margin: 1rem 0; text-align: center; } .calc-chart svg { max-width: 100%; height: auto; } .calc-chart-legend { display: flex; flex-wrap: wrap; justify-content: center; gap: 0.6rem 1.2rem; margin-top: 0.6rem; font-size: 0.8rem; color: #555; } .calc-chart-legend span { display: inline-flex; align-items: center; gap: 0.3rem; } .calc-chart-legend i { display: inline-block; width: 10px; height: 10px; border-radius: 2px; font-style: normal; } .calc-related { max-width: 640px; margin: 2rem 0 1rem; padding: 1.25rem 1.5rem; background: #f8f9fa; border: 1px solid #e8e8e8; border-radius: 8px; } .calc-related h3 { font-family: Georgia, serif; font-size: 1rem; color: #1a1a1a; margin: 0 0 0.75rem; padding-bottom: 0.4rem; border-bottom: 2px solid var(--ac, #3d5a80); } .calc-related-list { list-style: none; padding: 0; margin: 0 0 0.75rem; display: grid; grid-template-columns: 1fr 1fr; gap: 0.4rem 1.5rem; } .calc-related-list li a { font-size: 0.88rem; color: var(--ac, #3d5a80); text-decoration: none; } .calc-related-list li a:hover { text-decoration: underline; } .calc-browse-all { margin: 0.5rem 0 0; font-size: 0.9rem; font-weight: 600; } .calc-browse-all a { color: var(--ac, #3d5a80); text-decoration: none; } .calc-browse-all a:hover { text-decoration: underline; } @media (max-width: 720px) { .calc-related-list { grid-template-columns: 1fr; } }

Phishing Risk Assessment Calculator

Estimate your organization's phishing risk score and expected annual phishing incidents based on workforce size, security awareness training, email volume, and existing controls.

Number of Employees

Security Awareness Training Frequency

No Training Annual Semi-Annual Quarterly Monthly

Baseline Phishing Click Rate (%)

Industry average without training: ~30%. With training programs: 10–15%.

Phishing Emails Received Per Employee Per Day

Average office worker receives ~4 phishing emails/day (Tessian 2021).

Spam/Email Filter Effectiveness (%)

Modern email filters block ~85–99% of phishing emails.

Multi-Factor Authentication (MFA) Deployed?

No Yes — Partial (<50% of systems) Yes — Majority (50–90% of systems) Yes — Full (>90% of systems)

Average Cost Per Phishing Incident (USD)

IBM 2023 reports average phishing incident cost ~$4.76M for breaches; smaller incidents average $1,600–$17,700.

Calculate Phishing Risk

function phiCalc() { // --- Grab inputs --- var employees = parseFloat(document.getElementById('phi-employees').value); var trainingFreq = parseFloat(document.getElementById('phi-training').value); var clickRatePct = parseFloat(document.getElementById('phi-click-rate').value); var emailsPerDay = parseFloat(document.getElementById('phi-emails-per-day').value); var filterPct = parseFloat(document.getElementById('phi-spam-filter').value); var mfaLevel = parseFloat(document.getElementById('phi-mfa').value); var incidentCost = parseFloat(document.getElementById('phi-incident-cost').value);

// --- Validation --- var errors = []; if (isNaN(employees) || employees 100) errors.push("Click rate must be between 0.1% and 100%."); if (isNaN(emailsPerDay) || emailsPerDay = 100) errors.push("Spam filter effectiveness must be between 0% and 99.9%."); if (isNaN(incidentCost) || incidentCost 0) { document.getElementById('phi-result').style.display = 'block'; document.getElementById('phi-result').innerHTML = 'Please fix the following:' + errors.map(function(e){ return ''; }).join('') + ''; return; }

// --------------------------------------------------------------- // STEP 1: Training Reduction Factor // Each training session per year reduces click rate by ~5% // (relative reduction), capped at 70% total reduction. // Source: Proofpoint State of the Phish 2023 // trainingReduction = min(trainingFreq * 0.05, 0.70) // --------------------------------------------------------------- var trainingReduction = Math.min(trainingFreq * 0.05, 0.70); var adjustedClickRate = (clickRatePct / 100) * (1 - trainingReduction);

// --------------------------------------------------------------- // STEP 2: Emails reaching employees after filter // emailsReaching = emailsPerDay * employees * (1 - filterPct/100) * 365 // --------------------------------------------------------------- var filterFactor = 1 - (filterPct / 100); var annualEmailsIn = emailsPerDay * employees * 365; var emailsReaching = annualEmailsIn * filterFactor;

// --------------------------------------------------------------- // STEP 3: Raw clicks (potential incidents before MFA) // rawClicks = emailsReaching * adjustedClickRate // --------------------------------------------------------------- var rawClicks = emailsReaching * adjustedClickRate;

// --------------------------------------------------------------- // STEP 4: MFA Mitigation Factor // MFA reduces successful credential-based attacks. // Level 0 = 0% mitigation // Level 1 = 40% mitigation (partial) // Level 2 = 70% mitigation (majority) // Level 3 = 90% mitigation (full) // Source: CISA, Microsoft Security Intelligence Report // --------------------------------------------------------------- var mfaMitigation = [0, 0.40, 0.70, 0.90][mfaLevel]; var successfulIncidents = rawClicks * (1 - mfaMitigation);

// --------------------------------------------------------------- // STEP 5: Risk Score (0–100) // Normalized score based on incident rate per employee // incidentRate = successfulIncidents / employees // riskScore = min(incidentRate / 50, 1) * 100 // (50 incidents/employee/year = maximum risk score of 100) // --------------------------------------------------------------- var incidentRatePerEmployee = successfulIncidents / employees; var riskScore = Math.min((incidentRatePerEmployee / 50) * 100, 100);

// --------------------------------------------------------------- // STEP 6: Annual Expected Cost // annualCost = successfulIncidents * incidentCost // --------------------------------------------------------------- var annualCost = successfulIncidents * incidentCost;

// --------------------------------------------------------------- // STEP 7: Risk Level Label // --------------------------------------------------------------- var riskLabel, riskColor; if (riskScore '; html += '' + fmt(riskScore,1) + ' / 100'; html += 'Risk Level: ' + riskLabel + ''; html += '';

html += ''; var rows = [ ["Annual Phishing Emails (Total)", fmt(annualEmailsIn,0)], ["Emails Reaching Employees (after filter)", fmt(Math.round(emailsReaching),0)], ["Filter Blocked", fmt(Math.round(annualEmailsIn - emailsReaching),0)], ["Adjusted Click Rate (after training)", (adjustedClickRate100).toFixed(2) + "%"], ["Raw Clicks / Potential Incidents", fmt(Math.round(rawClicks),0)], ["MFA Mitigation Factor", (mfaMitigation100).toFixed(0) + "%"], ["Estimated Successful Incidents / Year", fmt(Math.round(successfulIncidents),0)], ["Incidents Per Employee / Year", incidentRatePerEmployee.toFixed(2)], ["Phishing Exposure Index (PEI)", pei.toFixed(2) + " exposures/employee/yr"], ["Estimated Annual Financial Exposure", fmtUSD(annualCost)], ["Risk Score", fmt(riskScore,1) + " / 100 (" + riskLabel + ")"] ]; rows.forEach(function(r, i) { var bg = i % 2 === 0 ? '#f9f9f9' : '#fff'; html += ''; html += '' + r[0] + ''; html += '' + r[1] + ''; html += ''; }); html += '';

// Recommendations html += ''; html += 'Key Recommendations:'; if (trainingFreq 0.10) html += ''; if (riskScore >= 65) html += '- Critical risk detected — immediate security review recommended.'; html += '';

document.getElementById('phi-result').style.display = 'block'; document.getElementById('phi-result').innerHTML = html; }

#### Formulas Used

1. Training Reduction Factor: trainingReduction = min(trainingFrequency × 0.05, 0.70) Each annual training session reduces the baseline click rate by 5% (relative), capped at 70%.

2. Adjusted Click Rate: adjustedClickRate = baselineClickRate × (1 − trainingReduction)

3. Annual Emails Reaching Employees: emailsReaching = emailsPerDay × employees × 365 × (1 − filterEffectiveness)

4. Raw Clicks (Potential Incidents): rawClicks = emailsReaching × adjustedClickRate

5. Successful Incidents (after MFA): successfulIncidents = rawClicks × (1 − mfaMitigationFactor) MFA mitigation: None=0%, Partial=40%, Majority=70%, Full=90%

6. Risk Score (0–100): riskScore = min((successfulIncidents / employees) / 50, 1) × 100 50 incidents per employee per year represents maximum (score = 100).

7. Annual Financial Exposure: annualCost = successfulIncidents × costPerIncident

8. Phishing Exposure Index (PEI): PEI = (emailsReaching / employees) × adjustedClickRate Average annual phishing exposures per employee.

#### Assumptions & References

Phishing Risk Assessment Calculator

Phishing Risk Assessment Calculator

More Calculators

Read Next

References

Phishing Risk Assessment Calculator

Phishing Risk Assessment Calculator

More Calculators

Read Next

References

Related Authorities