NIST: Phish Scale User Guide

The phishing cyber threat exploits vulnerabilities in the U.S. and around the world across private and public sectors. Embedded phishing awareness training programs, where simulated phishing emails are sent to employees, are designed to prepare employees in these organizations to combat real-world phishing scenarios.

Cybersecurity and phishing awareness training implementers and practitioners use the results of these programs, in part, to assess the security risk of their organization. The NIST Phish Scale is a method created for cybersecurity and phishing awareness training implementers to rate an email’s human phishing detection difficulty as part of their cybersecurity awareness and phishing training programs.