Security teams should correlate behavior, identity and access, and threat intelligence to build a risk picture at the individual level. Clicks in simulations matter, but they are not enough on their own. High-risk users often combine elevated access, repeated risky behavior, and active external targeting. That combination lets teams prioritise interventions before a real phishing message turns into credential theft or fraud.
Why phishing susceptibility is a risk-scoring problem, not a quiz score problem
Teams get better results when they treat phishing susceptibility as an evolving risk profile, not a static label based on simulation clicks. The strongest signal comes from combining behaviour, access context, and external targeting into one view. That means separating ordinary user error from users whose failure would create a larger security consequence because of the access they hold or the data they can reach.
A useful model starts with exposure, not blame. Two users can click at the same rate, but the one with privileged access, repeated risky behaviour, and active targeting by criminals is a materially different risk. That is why individual scoring should inform prioritisation, not punishment.
For teams building that picture, the underlying identity and access context matters because privilege changes the likely impact of a compromise, and threat intelligence changes the likelihood of exploitation. NHIMG’s 2026 Identity Security Trends & Predictions reinforces that visibility and least privilege are central to understanding which identities deserve tighter scrutiny.
Which signals actually improve prediction
The most useful predictors are the ones that change the probability of successful compromise or the blast radius if a phishing attempt succeeds. Repeated clicks in simulations matter, but they are only one input. Add account privilege, recent access to sensitive systems, unusual login patterns, security exceptions, and evidence that an account or role is already being singled out by external actors.
Behavioural signals should be interpreted as patterns over time, not one-off mistakes. A user who clicks once, reports the message, and shows no other risky pattern is different from a user who repeatedly enters credentials, ignores warnings, and works in a role that adversaries routinely target. The second case deserves faster intervention because the combination suggests both susceptibility and consequence.
Threat intelligence makes the model sharper when it identifies real-world targeting of similar roles, industries, or systems. Teams should use it to rank urgency, especially where a campaign is likely to move from phishing to token theft, mailbox compromise, or fraud. The CISA cyber threat advisories are useful for translating broad campaign activity into concrete user and role exposure.
How to turn prediction into prioritised intervention
Prediction only matters if it changes action. High-risk users should receive interventions that match the specific failure mode, such as targeted coaching, tighter authentication controls, tighter review of inbox rules or forwarding, and more aggressive monitoring of anomalous access. Users with elevated access should be handled with greater urgency because a single compromise can create disproportionate downstream damage.
Teams should also avoid overfitting to simulation data. A poor simulation score may justify extra training, but it does not by itself prove that the user is the highest operational risk. The practical question is whether the user is both likely to be fooled and likely to cause material harm if fooled.
What to verify: confirm that the scoring model can explain why a user is high risk in terms of access, behaviour, and exposure, not just click history. If the model cannot distinguish low-consequence users from high-consequence users, it is not ready for operational use.
Common mistake: treating phishing prediction as a training leaderboard. That approach misses the users whose compromise would actually matter most to the business.
Practitioner takeaway: the best phishing prediction models rank users by combined susceptibility and potential impact, then feed that ranking into targeted control changes before an email becomes a compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | User phishing risk depends on role, access, and business impact context. |
| ID.RA-04 — Risk Assessment | This question is about estimating which users are most likely to be compromised. | |
| Recommendation — Prioritise users whose compromise would affect critical services, data, or operations. Use behavioral, access, and threat signals to rank user phishing risk. | ||
| NIST SP 800-53 Rev 5 | RA-3 — Risk Assessment | Predicting phishing susceptibility requires an assessed threat and exposure profile. |
| IA-2 — Identification and Authentication | Phishing prediction improves when teams account for authentication exposure and compromise impact. | |
| Recommendation — Assess user-level exposure and exploitation likelihood before setting intervention priority. Strengthen authentication for users with elevated phishing exposure and impact. | ||
| CIS Controls v8 | 6 — Access Control Management | Elevated access materially changes the consequence of phishing-driven compromise. |
| Recommendation — Prioritise tighter access review for users whose compromise would create broad exposure. | ||
| OWASP API Security Top 10 | BOLA — Broken Object Level Authorization | Compromised user accounts can abuse access boundaries if authorization is weak. |
| Recommendation — Verify that high-risk accounts cannot reach objects beyond their intended authorization scope. | ||
