Predicted Compromise Rate is a forecast of how many users are likely to fall for a given simulation scenario. Security teams use it to calibrate difficulty, compare expected versus actual susceptibility, and turn simulation outcomes into a more precise measure of resilience across roles, departments, and threat types.
What the forecast measures
Predicted Compromise Rate is a planning metric, not a retroactive score. It estimates the proportion of participants likely to fail a specific simulation, which lets teams compare scenarios on a common scale and distinguish a difficult test from one that is merely unfamiliar or poorly targeted.
Because the metric is scenario-specific, it should be read as a forecast of susceptibility under controlled conditions. A high predicted rate may reflect role exposure, weak familiarity with the lure, or a test design that is intentionally harder than average; it does not automatically mean the organisation has broad security weakness.
How to interpret predicted compromise rate
The value is most useful when it is compared with actual outcomes, segmented by role or department, and viewed alongside the attack theme being simulated. That context helps teams see whether a scenario is realistic, whether it is testing the right population, and whether results are consistent across repeated exercises.
In practice, the metric supports calibration. If the predicted rate is far above the observed rate, the simulation may have been too obvious or too artificial. If the observed rate is much higher than predicted, the organisation may have underestimated how persuasive that threat type is for the audience being tested.
What makes the metric useful
Predicted Compromise Rate adds value because it turns simulation design into something measurable. Rather than treating every campaign as a pass or fail exercise, teams can use the forecast to compare difficulty across scenarios, track whether awareness efforts are changing susceptibility, and avoid overreacting to one-off outliers.
It is also useful for programme design because not all groups fail for the same reasons. Different departments, access patterns, and threat types produce different results, so a single organisation-wide average can hide important variation. The metric is strongest when it is used to explain those differences, not to flatten them.
How it supports resilience measurement
Used well, the forecast helps convert simulation results into a resilience signal. A lower-than-predicted compromise rate may indicate that training, verification habits, or reporting behaviours are improving. A higher-than-predicted rate can identify where additional controls, coaching, or scenario refinement are needed.
For that reason, the metric is best treated as one input to a broader resilience picture, not as a standalone judgement. It becomes more meaningful when it is paired with reporting rates, response speed, and the specific failure modes the simulation was designed to test.
Risk and Threat Considerations
Forecasting compromise rate can create a false sense of precision if the scenario design, sample size, or audience mix is weak. A bad forecast may mask an exposed population, while a good forecast can still be undermined if the simulation does not resemble the threats employees actually face.
Failure mechanism: The metric becomes misleading when it is used as a proxy for real-world resilience without validating the scenario, the population being tested, and the attack type being modelled.
Impact: Teams may prioritise the wrong remediation work, miss pockets of elevated susceptibility, or wrongly conclude that control and awareness improvements are more effective than they really are.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerability Identification | Predicted compromise rates support identifying susceptibility in defined user groups. |
| GV.RM-01 — Risk Management Strategy | The metric informs how organisations compare and prioritise awareness and resilience risk. | |
| Recommendation — Use ID.RA-01 to assess where particular roles or groups are more likely to fail simulation scenarios. Use GV.RM-01 to fold simulation forecasts into a repeatable risk evaluation approach. | ||
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | The term measures susceptibility to simulated social-engineering style threats. |
| Recommendation — Use CIS-14 to tune awareness efforts based on forecast and observed compromise patterns. | ||
| NIST SP 800-53 Rev 5 | AT-2 — Awareness Training | The forecast helps evaluate how training affects user susceptibility to simulated attacks. |
| AT-4 — Training Records | Comparing expected and actual outcomes depends on recorded training coverage and participation. | |
| Recommendation — Use AT-2 to target training where predicted compromise remains high. Use AT-4 to retain training evidence that helps explain forecasted and observed susceptibility. | ||
Practitioner Guidance
Why practitioners should care: Treat the forecast as a calibration tool, not a score to optimise in isolation. Its value is in helping security teams compare scenarios consistently and understand whether measured outcomes are better or worse than expected.
Common misunderstanding: A predicted compromise rate is not a universal vulnerability benchmark. It only makes sense when tied to a specific simulation design, audience segment, and threat theme.
Practitioner takeaway: Use the forecast to sharpen exercise design and interpret variance, then review outliers by role, department, and scenario rather than relying on one organisation-wide figure.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org