A single convincing email can bypass years of technology investment. An accounts payable employee who changes bank details, a manager who approves a fake Microsoft 365 sign-in prompt, or an executive whose mailbox is taken over can create financial, operational, and legal consequences within hours. Knowing how to evaluate phishing risk gives business leaders a practical way to identify where that exposure exists before an attacker finds it.
Phishing risk is not limited to whether employees can spot a suspicious message. It is the combined risk created by user behavior, email and identity controls, business processes, and the organization’s ability to detect and contain an incident. A useful assessment looks at all four.
Start With the Business Impact
Begin with the systems, people, and transactions that would cause the most disruption if compromised. Phishing campaigns are usually designed to steal credentials, redirect payments, deploy malware, or gain access to sensitive data. The same email may be an inconvenience for one organization and a major outage for another.
Identify the roles with authority over money, confidential records, privileged accounts, and customer communications. Finance teams, executives, HR, IT administrators, sales leaders, and employees with access to Microsoft 365 are common targets. In multi-site businesses, location managers and local administrators may also have access that attackers can exploit.
Then define the likely business consequences. A compromised mailbox might expose contracts and invoices. Stolen Microsoft 365 credentials can give an attacker access to SharePoint, Teams, OneDrive, and internal conversations. A successful business email compromise can interrupt vendor payments and damage customer trust. This step helps leadership judge risk in business terms rather than treating every suspicious email as equal.
Map the Most Common Attack Paths
A phishing risk assessment should focus on how an attacker could realistically enter and move through your environment. Review recent phishing attempts, helpdesk tickets, spam reports, and security alerts. These records often reveal whether your organization is seeing credential theft, invoice fraud, QR-code phishing, malicious attachments, or impersonation attempts.
Look beyond email, too. Attackers may use text messages, social media, fake support calls, or compromised vendor accounts to make a request appear legitimate. A user who understands that a message looks suspicious may still act if the request arrives during a busy period and appears to come from a trusted executive or supplier.
Assess the controls at each point in the path: delivery, user interaction, authentication, access, and response. A filtered email that reaches an inbox is one problem. A user entering credentials into a fake website is another. If those credentials cannot be used because multifactor authentication and conditional access block the attempt, the overall risk is lower. If the attacker can immediately access email and cloud files, the risk is much higher.
How to Evaluate Phishing Risk Across People
Employee awareness matters, but training completion alone is not a reliable measurement. A business may show high training participation while users still struggle with realistic messages that impersonate vendors, use QR codes, or create urgency around payroll and invoices.
Use phishing simulations to measure behavior in a controlled setting. The goal is not to embarrass employees or create a pass-fail culture. It is to identify patterns: which departments interact with suspicious messages, which types of lures work, and whether employees report messages quickly.
Review results by role and scenario. Finance staff may need stronger verification procedures for payment changes. Executives may need focused guidance on impersonation and account takeover. New employees, temporary workers, and users with limited technology experience may need more frequent reinforcement. A single company-wide training module rarely addresses every risk equally well.
Also measure reporting behavior. Fast reporting can limit an incident even when a user clicks. Employees should know exactly how to report a suspicious message and feel comfortable doing so. If reporting requires forwarding emails, opening a helpdesk request, or trying to decide whether an issue is serious enough, reports may arrive too late.
Review Email and Microsoft 365 Protections
Email security controls should be reviewed as a working system, not as a one-time configuration exercise. Start by confirming that your organization has authentication protections in place for its domains, including SPF, DKIM, and DMARC. These controls help reduce direct spoofing of your domain, though they do not stop every impersonation attempt.
Next, examine the protections that screen inbound mail. Effective filtering should identify malicious links, dangerous attachments, display-name impersonation, newly created sender domains, and common business email compromise patterns. The right configuration depends on your email platform, industry, and communication needs. Overly aggressive filtering can delay legitimate vendor messages, while permissive settings leave users to make too many security decisions on their own.
Microsoft 365 security deserves particular attention because a stolen account can become an attacker’s launching point. Confirm that multifactor authentication is enforced for all users, with stronger protections for administrators and finance personnel. Review legacy authentication, risky sign-in policies, mailbox forwarding rules, application consent, and privileged account access.
Mailbox forwarding is especially important. Attackers frequently create hidden forwarding rules after compromising an account so they can monitor conversations and wait for a payment opportunity. Review who can create external forwarding rules, alert on changes, and investigate unexpected inbox rule activity.
Test the Processes That Stop Fraud
Phishing succeeds when a deceptive request defeats a business process. Technology can block many threats, but payment verification, vendor management, and password reset procedures are equally important.
For high-risk transactions, require independent verification using a known phone number or established contact method. Do not rely on the phone number, link, or reply address contained in the email that requested the change. This applies to bank detail changes, wire transfers, payroll updates, gift card requests, and urgent requests from executives.
Review whether employees can identify an exception process. Attackers often create urgency by claiming a leader is traveling, a vendor account is locked, or a payment deadline is imminent. A disciplined process gives employees authority to pause, verify, and escalate without fearing that they are slowing down the business.
Password reset and account recovery workflows also need review. If an attacker can persuade a helpdesk agent to reset access using information found online, phishing risk extends beyond the inbox. Identity verification procedures should match the sensitivity of the account being recovered.
Score Likelihood, Impact, and Control Gaps
A simple risk score helps turn assessment findings into decisions. For each scenario, consider the likelihood that it will occur, the impact if it succeeds, and the effectiveness of existing controls. A finance employee with broad access, no enforced multifactor authentication, and no callback procedure for payment changes represents a high-priority finding.
Use consistent ratings so leadership can compare risks across departments and sites. The assessment should document the affected users or systems, the likely attack method, current safeguards, remaining exposure, accountable owner, and target remediation date. This creates operational clarity rather than a list of vague recommendations.
Prioritize gaps that combine high impact with realistic likelihood. Common high-value improvements include enforcing multifactor authentication, removing legacy sign-in methods, strengthening email filtering, limiting administrator rights, restricting external forwarding, improving payment verification, and creating a tested process for reporting suspicious messages.
Not every issue requires the same response. A specialized vendor workflow may require a carefully tuned email rule instead of a broad block. A small team may need a streamlined approval process that preserves speed while adding independent verification. Risk reduction works best when controls fit the way the business actually operates.
Validate Incident Response Readiness
The final measure of phishing risk is how well the organization responds when prevention fails. Ask whether staff know who to contact, whether IT can quickly disable an account, revoke sessions, remove malicious messages from other inboxes, and review mailbox activity. Confirm that finance, operations, legal, and leadership know their responsibilities for a suspected payment fraud or data exposure event.
Run a tabletop exercise around a realistic scenario, such as a compromised Microsoft 365 account sending fraudulent invoice instructions. Measure how quickly the issue is reported, who makes containment decisions, whether vendor contacts are available, and how the organization communicates internally. The gaps found in a short exercise are often more useful than assumptions made on paper.
Phishing risk changes as staff, vendors, cloud services, and attacker tactics change. Review it on a scheduled basis and after major changes to email, identity, finance workflows, or staffing. The practical goal is not to promise that no user will ever click. It is to build layered controls and clear response procedures so one deceptive message does not become a business interruption.