Phishing Risk Score: Measure Your Organisation's Phishing Resilience

Phishing is a form of social engineering in which cybercriminals impersonate a trusted party -- a bank, supplier, colleague or government agency -- to trick victims into sharing sensitive information, clicking on a malicious link or transferring money. The word derives from "fishing": the attacker casts a line and hopes someone bites. Phishing has been the most common attack vector for more than two decades and is responsible for more than 90% of all successful cyber attacks.

Classic signals include unusual sender addresses (watch for subtle spelling differences), urgent or threatening language ("your account will be blocked within 24 hours"), unexpected attachments, suspicious links (hover over the link to see the actual address), language errors and requests for sensitive information that the legitimate organisation would never ask for by email. Modern phishing is becoming increasingly harder to detect, however. AI-generated emails no longer contain language errors, and personalised spear phishing uses information from LinkedIn and company websites. That is why ongoing training with regular simulations is more effective than relying on recognition cues alone.

According to the KnowBe4 Phishing Industry Benchmarks, an average of 34% of untrained employees click on a phishing link. After 90 days of security awareness training, this drops to an average of 18%. After a year of continuous training with regular simulations, the click rate drops to an average of 5%. The exact percentage varies significantly by sector: healthcare and education typically score higher, while the financial sector and technology companies score lower due to stricter compliance requirements and higher security awareness.

Best practice is to conduct phishing simulations at least quarterly, preferably monthly. Research shows that the effect of a one-off training fades within three months. Regular simulations keep employees alert and create a measurable trend that allows you to demonstrate the effectiveness of your awareness programme. Variation is key: alternate between standard phishing, spear phishing, smishing (SMS) and vishing (voice), and vary the difficulty level. A good simulation programme is not intended to punish employees, but to foster learning and continuously strengthen the organisation's resilience.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that works in conjunction with SPF and DKIM to prevent attackers from sending emails that appear to originate from your domain. Without DMARC, an attacker can send an email that appears in your customer's inbox as though it came from your organisation. With DMARC set to "reject", such forged emails are blocked. Additionally, DMARC provides reports that show who is sending emails on behalf of your domain. Despite its importance, according to research only 30% of Dutch organisations have DMARC correctly configured at enforcement level.

MFA (Multi-Factor Authentication) is one of the most effective layers of defence against phishing. If an employee accidentally enters credentials on a phishing page, the attacker cannot log in without the second factor (SMS code, authenticator app or hardware key). Microsoft estimates that MFA blocks more than 99% of credential-based attacks. Note, however, that advanced attackers use real-time phishing proxies (such as EvilGinx) that can also intercept MFA tokens. The strongest protection is provided by phishing-resistant methods such as FIDO2 keys and passkeys, which are cryptographically bound to the legitimate domain and cannot be transferred to a phishing site.

Regular phishing is mass-distributed and impersonal: the same generic email is sent to thousands or millions of recipients. The click rate is low, but the volume makes it profitable for attackers. Spear phishing targets a specific individual or small group, with personalised content based on publicly available information. A spear phishing email might reference a recent project, mention a colleague by name or capitalise on a current company event. Due to this personalisation, the click rate for spear phishing is up to ten times higher than for regular phishing. Business Email Compromise (BEC) is the most advanced form: the attacker impersonates the CEO or CFO and requests a financial transaction.

The costs depend heavily on the type of attack and its consequences. A successful Business Email Compromise costs an average of 125,000 euros per incident, according to FBI IC3 data. If a phishing attack leads to a data breach, costs escalate to an average of 4.76 million dollars globally (IBM Cost of a Data Breach 2024). For Dutch SMEs, the average costs of a cyber incident caused by phishing range between 50,000 and 200,000 euros, including direct damage, recovery costs, productivity loss and legal expenses. In addition, there are indirect costs such as reputational damage and customer attrition that are difficult to quantify but are often substantial.