Arsen calculates a security score for each employee from their recent simulation results and their training. The score reflects the actual risk: an old good result can't hide a recent click, ignoring a simulation no longer passes for good behavior, and progress shows within a few campaigns.
What is an employee security score?
An employee security score turns the results of phishing, smishing and vishing simulations and of security awareness training into one indicator of human risk per person. It shows security and GRC teams which employees and groups are most exposed to social engineering, where to follow up, and how the risk evolves over time. A score is only useful when it rewards the behaviors that stop a real attack, such as reporting a suspicious message, and penalizes the ones that lead to a compromise.
How it works
Each employee's score combines two parts: 60% simulations (phishing, smishing and vishing) and 40% training, which covers both completing modules and passing them.
Five rules shape the simulation part:
- ⏱️ Recent behavior counts most. A result from 6 months ago counts half as much as a recent one, and after 2 years it no longer counts. Old good results can't hide a recent click, and progress shows quickly.
- 🔇 Ignoring a simulation counts much less. An ignored simulation, with no click and no report, counts five times less than a real reaction. It can't make up for a compromise.
- 🚩 Reporting is the goal. Reporting scores 100. Risky actions score between 50 and 0, depending on whether data was compromised and whether the employee reported it.
- 🎯 Difficulty is fair. Spotting a hard scenario earns more credit. Failing an easy one costs more.
- 📚 Training counts too. Completing modules and passing them make up 40% of the score.
What drives the score
| Simulation outcome or factor | How it counts |
|---|---|
| Reported | Scores 100 |
| Risky action | Scores between 50 and 0, depending on whether data was compromised and whether the employee reported it |
| Ignored (no click, no report) | Counts five times less than a real reaction |
| Hard scenario spotted | Earns more credit |
| Easy scenario failed | Costs more |
| Result from 6 months ago | Counts half as much as a recent one |
| Result older than 2 years | No longer counts |
- A campaign that employees ignore says little about their risk, so it weighs little in the score.
- A campaign where employees click, enter data or report says a lot. Reporting is the behavior the score rewards most.
How to read the scores
Most employees ignore most simulations. When ignoring a simulation counted almost as much as reporting it, scores settled around 50 and hid the employees who actually clicked. The same history, scored this way, shows the risk that was already there.
Take an employee who entered their credentials twice in two months and let their training expire. Under the earlier method, they scored about 47. Under this one, they score about 7.
A low score is a signal to follow up, not a penalty. Compare employees and groups with each other, and track the trend from this point on: scores from the earlier method don't measure the same way and can't be compared with these.
-
Ignoring a simulation used to count almost as much as reporting it. Most employees ignore most simulations, so scores settled around 50 and hid the employees who actually clicked. Take an employee who entered their credentials twice in two months and let their training expire. Before, they scored about 47. With this method, they score about 7.
-
No. The same history is scored differently, and the score shows the risk that was already there. A low score is a signal to follow up, not a penalty.
-
No. The two methods don't measure the same way. Compare employees and groups with each other, and track the trend from this point on.
-
Encourage reporting, and make sure training gets completed. Recent behavior weighs most, so scores improve within a few campaigns.
