The Employee Security Index (ESI) can worsen even though no new clicks have occurred in simulated attacks.
This does not automatically mean that a user clicked on a simulated attack again. The ESI is recalculated regularly. What matters is which events currently fall within the calculation period.
Brief explanation
The ESI considers a specific time period.
If older simulated attacks without clicks fall out of this period, an existing click can carry more weight. As a result, the ESI can decrease even though no new click has occurred.
Example representation of a 5-day calculation period: Even though no new clicks occur, the ESI can decrease if fewer emails without clicks are included in the period.
Example
The following example shows in a simplified way how the calculation period shifts.
Calculation on 03/09
In the period 03/05–03/09, there are many simulated attacks without clicks.
On 03/09, a user clicks on a simulated attack.
Example:
| Period | Emails in period | Clicks in period |
|---|---|---|
| 03/05–03/09 | 30 | 1 |
The click counts but is balanced by many emails without clicks.
Calculation on 03/12
In the period 03/08–03/12, the same click from 03/09 is still included.
However, there are fewer emails without clicks included in the period.
Example:
| Period | Emails in period | Clicks in period |
|---|---|---|
| 03/08–03/12 | 10 | 1 |
No new click has been added. However, the existing click carries more weight because fewer non-critical emails fall within the period. This can cause the ESI to decrease.
Calculation on 03/14
In the period 03/10–03/14, the click from 03/09 is no longer included.
Example:
| Period | Emails with clicks in period | Clicks in period |
|---|---|---|
| 03/10–03/14 | 0 | 0 |
The click is no longer considered. As a result, the ESI can improve again.
Why is this important?
A decreasing ESI does not automatically mean that new clicks have occurred.
When evaluating, also check:
- the calculation period considered
- the timing of existing clicks
- the number of simulated attacks in the period
- the number of user actions in the period
The Employee Security Index is recalculated regularly. Changes can also result from the current calculation period.
Summary
The ESI can decrease even though no additional clicks have occurred if the calculation period shifts.
What matters is not only whether new clicks have occurred but which simulated attacks and user actions are currently included in the calculation.