Skip to content
ENExplore Calculators

Phishing Risk Calculator

Model phishing exposure from campaign volume, click and report rates, credential entry, MFA strength and expected compromises.

About Phishing Risk Calculator

Compromise is a funnel: delivered mail, clicks, credential submissions, then whether the second factor survives the attack. The MFA factor is the dominant term — push-based MFA is fatigued and OTPs are relayed by any modern phishing kit, while FIDO2 is bound to the origin and simply does not phish. Containment reflects that a fast report lets you retract the mail and reset the account before the session is used. The report-to-click ratio is the awareness metric that predicts outcomes: an organisation where more people report than click detects campaigns in minutes, and one where clicks dominate finds out from the SOC.

Formula

Phishing Risk

expectedCompromises = users × emails × clickRate × credentialEntryRate × mfaBypassFactor × containmentFactor.

clickRate
Share of delivered phishing emails clicked
credentialEntryRate
Share of clickers who submit credentials
mfaBypassFactor
Probability the MFA in place fails to stop the attack — 1.0 for none, 0.01 for FIDO2
containmentFactor
Reduction from users reporting quickly enough to retract and reset

Worked example

With the default values below, Phishing Risk Calculator returns Expected Account Compromises per Year of 17.2. Change any input above and every figure here is recalculated in your browser.

Inputs used

Users targetedaccepts 1–10,000,000 users
2,500 users
Phishing emails reaching the inbox per user per yearaccepts 0–10,000 emails/year
6 emails/year
Click rateaccepts 0–100 %
8 %
Of those who click, share entering credentialsaccepts 0–100 %
35 %
Report rateaccepts 0–100 %
20 %
MFA on the phished applicationone of None — credentials are enough — 1.0, SMS or voice OTP — 0.35, App-based OTP or push — 0.15, Number matching with context — 0.05, Phishing-resistant FIDO2 or certificate — 0.01
Number matching with context — 0.05
Time to contain a reported phishaccepts 1–10,080 minutes
45 minutes
Cost of one account compromiseaccepts 0–100,000,000 currency
35,000 currency

Results

Expected Account Compromises per Year
17.2 accounts/year
Clicks per Year
1,200 clicks/year
Credential Submissions per Year
420.0 per year
Expected Annual Loss
$601,781
Report-to-Click Ratio
2.50 ×
Loss Avoided by Current MFA
$11,433,844
Priority Action
Well controlled — keep measuring with realistic simulations rather than easy ones

Step by step

  1. 1Values used
  2. 2Phishing Risk
  3. 3Expected Account Compromises per Year= 17.2 accounts/year
  4. 4Clicks per Year= 1,200 clicks/year
  5. 5Credential Submissions per Year= 420.0 per year
  6. 6Expected Annual Loss= 601,781
  7. 7Report-to-Click Ratio= 2.50 ×
  8. 8Loss Avoided by Current MFA= 11,433,844

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation or tax into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Phishing Risk calculated?

expectedCompromises = users × emails × clickRate × credentialEntryRate × mfaBypassFactor × containmentFactor. Compromise is a funnel: delivered mail, clicks, credential submissions, then whether the second factor survives the attack. The MFA factor is the dominant term — push-based MFA is fatigued and OTPs are relayed by any modern phishing kit, while FIDO2 is bound to the origin and simply does not phish. Containment reflects that a fast report lets you retract the mail and reset the account before the session is used.

Why does Phishing Risk matter?

The report-to-click ratio is the awareness metric that predicts outcomes: an organisation where more people report than click detects campaigns in minutes, and one where clicks dominate finds out from the SOC.

What values do I need to enter?

This calculator takes 8 inputs: Users targeted, Phishing emails reaching the inbox per user per year, Click rate, Of those who click, share entering credentials, Report rate, MFA on the phished application, Time to contain a reported phish, Cost of one account compromise. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does phishing-resistant MFA score 0.01 rather than 0?

Because attackers still succeed through consent phishing, device-code flows, session-token theft from an already-compromised endpoint and help-desk social engineering to enrol a new key. FIDO2 removes credential relay, not every path to the account.

Are simulation click rates comparable to real ones?

Only loosely. Simulations are typically easier to spot than a targeted attack and harder than bulk spam, so treat the figure as a trend line for your own population rather than an absolute probability.

Related Calculators

Phishing Risk Calculator | Calcrivo