What is the NIST Phish Scale?
The NIST Phish Scale is a method published by the US National Institute of Standards and Technology for rating how difficult a phishing message is to detect. It weighs the cues in the message against how well the message fits the recipient’s work.
How it works
A message with many cues, such as spelling errors and a mismatched sender, that has nothing to do with the recipient’s job is easy to spot. One with few cues that matches a real task, like an invoice to accounts payable, is hard.
Rating each simulation lets a program compare results across campaigns and raise difficulty as people improve.
Why it matters
Without a difficulty rating, a falling click rate might mean people improved, or that the tests got easier. The scale makes simulation results honest.
How Living Security helps
Living Security Phishing sets difficulty on five levels grounded in the NIST Phish Scale.
