Phish-Prone Percentage
The share of client users who click a link, open an attachment or enter credentials in a simulated phishing test.
Formula
Users who failed the simulation ÷ Users tested × 100
Why Track It
Phishing is how most client breaches start. The trend per client shows whether awareness training is working and gives the vCIO a concrete number to discuss at the business review.
How It Is Measured
Run simulated phishing campaigns at least monthly for each client using a security awareness platform. Count users who clicked, opened an attachment, enabled macros or submitted credentials, and divide by users who received the simulation. Report baseline, 90 day and 12 month figures per client.
Constraints
Only as meaningful as the simulations are realistic. It measures behavior on tests, not on real attacks, and it cannot show who reported a real phish.
Measurement Note
KnowBe4's 2025 Phishing by Industry Benchmarking Report found a 33.1% average baseline before training, falling 40% within three months and to 4.1% after 12 months of training. Easy simulations produce low numbers, so keep difficulty consistent.
Referenced In
Related KPIs
- Mean Time to Identify and Contain a BreachThe average days from the start of a confirmed security breach to its identification, plus the days from identification to containment.
- MFA CoverageThe share of client user accounts enforced to use multi-factor authentication, with admin accounts tracked separately.
Glossary and Answers
More in Security Operations
Whether the basic controls an MSP runs for clients are actually in place and working. These numbers show how exposed the client base is to the breach that ends a client relationship.
- Backup Success RateCentralized Services Lead
- Mean Time to Identify and Contain a BreachSecurity Lead
- MFA CoverageSecurity Lead
- Patch Compliance RateCentralized Services Lead
- Restore Test Pass RateCentralized Services Lead