Phishing is prevalent because it provides big rewards for relatively little effort on the part of a hacker. The past decade of security research shows that employees regularly fall victim to attacks and that phishing is considered one of the easiest ways to access corporate infrastructure. Per recent statistics, 25% of your employees will be phished in the next 12 months and when they do, they’ll inadvertently involve themselves in one of these malicious activities:

• Click a link that leads to a download website
• Post sensitive information to websites
• Open high-risk attachments

Measuring the effectiveness of any program should be based on performance outcomes. For security awareness programs, this entails charting secure vs. insecure practices and measuring them–both before and after the program. For a phishing simulation program the following KPIs could be used:

Serial Clickers rate: The % of employees that are failing sequential in the most recent campaigns (high-risk group)
Employee Resilience Score: The average number of successful simulation between failures (for the employees that are failing)
Group Risk distribution: the distribution of employees between high, medium, and low-risk group

CybeReady’s onboarding process (time-to-value) is essentially 48 hours. All we need is a file with your employee address book (name, email, role, region/language) and for you to whitelist our domains. However, the actual time-to-value highly depends on the customer collaboration and willingness to provide the necessary input within the requested time window, After all, this is a joint effort!

When calculating the total cost of a security awareness training program three elements should be factored in:
(1) Product cost (e.g. subscription fees, software license)
(2) Time: the time your IT team has to invest in order to deploy and operate the solution
(3) Number of simulations: how many times was the solution used to generate value

When looking to purchase a phishing simulation solution, most companies only calculate the product cost and fail to include the cost of required time to operate and most importantly how value (# of simulations will be retrieved).