Free phishing-readiness screening tool

Employee Phishing Readiness Assessment

Estimate employee phishing exposure, identify the weakest defenses and get a model-based recommendation for security-awareness training frequency.

Simple phishing-readiness screen

Combine employee behavior with protective controls

0–100 exposure index

Training & simulation results

Employees

people

Training completion

Months since last formal training

months

Simulation coverage

% staff

Latest simulated-phish click / credential-action rate

Use the percentage that clicked, opened a risky attachment or submitted credentials in the latest test. Latest simulated-phish reporting rate

Share of tested employees who reported the simulation through the intended channel.

Protective controls

ControlCurrent coverage / maturity

MFA on business email & cloud accountsCoverage across employee accounts.

Phishing-resistant MFA coverageShare using phishing-resistant methods where available.

Email filtering / anti-phishing maturity0 = minimal, 4 = enforced and regularly tuned.

/ 4

Easy employee reporting processReport button / clear channel, triage ownership and response.

/ 4

Payment / account-change verificationIndependent verification for invoices, banking changes and sensitive requests.

/ 4

Business exposure

Staff handling payments / payroll

% staff

Staff with sensitive customer / employee data

% staff

Remote / hybrid workforce

% staff

Executives / admins frequently targeted

% staff

Simple methodReadiness combines training completion and recency, simulation behavior, MFA, email defenses, reporting and verification controls. Business exposure reflects payment, sensitive-data, remote-work and privileged-user exposure. Preliminary phishing exposure = 70% readiness gap + 30% business exposure. Training frequency is an OfficeQ planning cadence based on the resulting exposure score, not a regulatory requirement.

Advanced phishing assessment

Score role groups and defensive controls separately

Role-based readiness

Employee role groups

Role groupEmployeesClick / risky actionReport rateRisk weight

General staffTypical business users.

Finance / AP / payrollHigh-value payment and account-change targets.

Executives / ownersFrequently impersonated and targeted for credential/payment fraud.

IT / admins / privileged usersAccounts with elevated system access.

Training program

Training completion

Months since formal training

months

New-hire phishing training coverage

Role-based training for high-risk staff

Protective controls

ControlCoverage / maturityWeight

MFA coverageBusiness email, cloud apps and remote access.

Phishing-resistant MFA coveragePhishing-resistant authentication where available.

Email filtering / anti-phishing0–4 maturity converted to 0–100.

Employee reporting workflowEasy reporting, triage ownership and feedback.

Payment / account-change verificationIndependent verification for financial and identity-changing requests.

Security-awareness training programCompletion, recency, onboarding and role-based coverage combined.

% quality

Phishing simulation programCoverage, follow-up and trend tracking.

% maturity

Domain / sender protectionsSPF/DKIM/DMARC and related sender-authentication defenses.

% maturity

Post-phish incident responseFast password reset, token/session revocation, mailbox review and escalation.

% maturity

Business exposure

Sensitive-data exposure

Payment-fraud exposure

Remote/cloud exposure

Third-party impersonation exposure

Advanced methodRole-group behavior produces a risk-weighted human readiness score. Protective controls are normalized by entered weights. Overall readiness = 45% human behavior + 55% protective controls. Preliminary exposure = 70% readiness gap + 30% business exposure. Improvement impact estimates the exposure-index reduction if one control reached full implementation with everything else unchanged.

Role-group exposure

Employee groups ranked by phishing exposure

Behavior × role-risk weight

Role group	Employees	Risk weight	Click / risky-action rate	Report rate	Behavior readiness	Group exposure priority

Improvement priorities

Controls ranked by modeled exposure reduction

Highest impact first

Priority	Control	Current strength	Normalized weight	Remaining gap	Exposure-index reduction if fully implemented

Training-cadence sensitivity

Recommended cadence as exposure changes

Planning bands, not regulatory requirements

Exposure index	Preliminary level	Recommended formal training	Reinforcement / simulation suggestion

Simulation improvement sensitivity

Exposure if employee behavior improves

All role groups adjusted together

Behavior scenario	Risk-weighted click rate	Risk-weighted report rate	Human readiness	Exposure index

Scope

Training is only one layer of phishing defense

This assessment is a planning screen, not a penetration test, compliance audit, breach-probability model or employee performance tool. Phishing resilience also depends on identity controls, email security, payment verification, reporting workflows and incident response. Use aggregate simulation data for program improvement rather than treating one test as a definitive measure of an individual employee.

Framework note: NIST small-business phishing guidance emphasizes teaching employees to recognize and report phishing. CISA guidance emphasizes MFA, including phishing-resistant MFA where available, and recommends user awareness and training that covers identifying and reporting suspicious activity. Neither source establishes the OfficeQ training-frequency bands used here; those bands are a model-based planning recommendation.