The problem with click rates
Two companies run phishing simulations. Here are their click rates.
Company A
9%
click rate
Company B
18%
click rate
Traditional metrics say Company A is safe and Company B is at risk.
Emails Sent
Company A
From: Amazon Rewards
"Congratulations!! You Won a $500 Gift Card!!!"
NIST difficulty1 / 7
Company B
From: David Park, Finance
"Re: Q2 budget reforecast — updated spreadsheet"
NIST difficulty6 / 7
Company A sent an obvious scam. 9% still clicked.
Company B sent a near-real email. Only 18% fell for it.
NIST Phish Scale Framework
The benchmark for measuring human phishing detection difficulty.
Every phishing email is scored from 1 to 7 based on how many red flags are visible and how well the scenario fits the recipient. Higher scores mean harder to detect.
- 1: Obvious
- 2–3: Easy
- 4: Moderate
- 5–6: Difficult
- 7: Realistic
Real-world example
In February 2024, a single email cost Pepco Group €15.5 million.
Email Example
From: Tomasz Nowak, CFO
t.nowak@pepcogroup.com
To: me
Subject: Re: Vendor payment — urgent processing needed
Hi Anna, Following up on the vendor payment we discussed in yesterday's call. The supplier has updated their banking details — I've attached the new wire instructions.
Can you process the transfer today? They've flagged it as overdue and it's holding up delivery for the Budapest distribution center.
Please don't loop in procurement on this one — I've already cleared it with their team directly and we need to move fast to avoid the late penalty.
Wire details attached. Let me know once it's sent.
Live NIST score
- Cues found: 0 / 6
- NIST score: 6 / 7
What they receive
Adaptive simulations that meet employees where they are.
Example email
From: Amazon Rewards promo@amaz0n-rewards.biz
Congratulations!! You Won a $500 Gift Card!!!
Dear Valued Customer, Your Amazon account has been selected for an exclusive $500 gift card reward!!! Click below to claim before it expires in 2 hours.
http://amaz0n-rewards.biz/claim?id=8x92k
NIST difficulty: 2 / 7
Easy for admins. Just right for employees.
Launch fully-automated phishing simulations that target each employee's role and evolve as they improve.