How this assessment is calculated

What the assessment does

The assessment combines your organisational context, your self-reported security practices, and evidence-informed maturity indicators to produce an organisational-level view of how well you currently measure and manage human-driven cyber risk. It is a maturity and exposure indicator — not a prediction of breach probability, and not a financial forecast.

The dimensions it evaluates

Your answers are interpreted across several dimensions of human-risk maturity:

• •Organisational context — sector and workforce scale shape how human risk concentrates and how it should be measured.
• •Security-awareness maturity — how consistently awareness is built across the workforce.
• •Phishing-simulation maturity — how regularly and realistically people are tested.
• •Behavioural measurement — how much visibility you have into what employees actually do, beyond training completion.
• •Reporting readiness — how easily employees can report suspicious messages, and whether that behaviour is measured.
• •Adaptive response capability — whether results shape what happens next, per person.
• •High-risk role coverage — whether roles that face different attacks are recognised and handled accordingly.
• •Human-risk governance — evidence of clear ownership of measurement.
• •Measurement continuity — whether measurement is continuous or only periodic.

The specific weightings and thresholds behind these dimensions are proprietary and are not published.

How your result is expressed

Your answers are rolled up into four headline views — human-risk exposure, measurement maturity, behavioural visibility, and reporting readiness — plus tailored strengths, gaps, an advisory "question to ask next", and a recommendation on whether continuous measurement would provide meaningful value. Every result statement is generated from your actual answers, not shown generically.

The illustrative value scenario

A financial scenario is shown only if you provide enough organisation-specific information. When you do, it is calculated transparently:

The improvement percentage is a clearly-labelled sensitivity assumption you choose — never a claim that PhishingPulse reduces breaches by a fixed amount. Your own measured improvement always takes precedence. If you don't supply enough data, we show a measurement gap instead of inventing a number.

What this assessment deliberately does not do

• ✕ It does not claim a percentage "chance of being breached".
• ✕ It does not treat a phishing simulation click rate as a breach probability.
• ✕ It does not multiply unrelated benchmark percentages to manufacture a loss figure.
• ✕ It does not claim a fixed breach-reduction figure for any product.
• ✕ It does not invent financial savings where data is missing.

Evidence foundation

The assessment is informed by recognised industry and academic sources, including the Verizon Data Breach Investigations Report (human involvement in breaches), FBI IC3 (BEC loss context), ENISA threat-landscape findings, the Microsoft Digital Defense Report, Palo Alto Unit 42, Proofpoint human-risk research, KnowBe4 simulation benchmarks, and NIST methodology (SP 800-30, SP 800-50 Rev. 1, and the Phish Scale). Vendor simulation benchmarks are treated as contextual susceptibility indicators, not universal breach probabilities. Where the research is mixed — for example, on how much conventional training changes behaviour — we represent that honestly.

Limitations

This is a self-reported assessment. Its accuracy depends on the answers provided, and it reflects organisational maturity rather than any individual's behaviour. It is a starting point for a conversation and a baseline measurement — not a substitute for measuring your workforce's actual behaviour, which is what a live PhishingPulse programme provides.