{
  "slug": "phishing-training-roi",
  "title": "Phishing Training ROI Calculator",
  "heading": "Phishing Training ROI Calculator",
  "category": "financial",
  "url": "https://www.revenuelab.fyi/toolbox/phishing-training-roi",
  "summary": "Quantify the return on security awareness training from reduced click rates.",
  "description": "Security awareness programs are one of the few controls where you can directly measure a before-and-after behavior change: click rate on simulated phishing tests. This calculator estimates the annual risk reduction value by comparing your baseline phish click rate to a post-training click rate, multiplying the delta by the number of phishing attempts your organization actually receives per year, and applying an average cost per successful phish (credential compromise, business email compromise, or malware execution). Industry benchmarks from Proofpoint and KnowBe4 show organizations running consistent quarterly simulated phishing and training typically cut click rates from an 30-35% baseline to under 5% within 12 months, though the largest gains come in the first two quarters. The ROI is usually dramatic on paper because a single prevented business email compromise ($130,000 median loss per FBI IC3 data) easily outweighs a full year of training platform licensing and program management time.",
  "formula": "Phishes prevented = attempts/year × (baseline click rate − trained click rate). Value = phishes prevented × avg cost per successful phish. ROI = (value − program cost) ÷ program cost.",
  "dateModified": "2026-09-30",
  "run_url": "https://www.revenuelab.fyi/api/public/calc?tool=phishing-training-roi",
  "inputs": [
    {
      "id": "attemptsYear",
      "label": "Phishing attempts received per year (est.)",
      "kind": "number",
      "hint": null,
      "default": 5000,
      "unit": null,
      "min": 0,
      "max": null
    },
    {
      "id": "baselineClick",
      "label": "Baseline click rate",
      "kind": "number",
      "hint": null,
      "default": 30,
      "unit": null,
      "min": 0,
      "max": 100
    },
    {
      "id": "trainedClick",
      "label": "Post-training click rate",
      "kind": "number",
      "hint": null,
      "default": 6,
      "unit": null,
      "min": 0,
      "max": 100
    },
    {
      "id": "costPerPhish",
      "label": "Average cost of a successful phish",
      "kind": "number",
      "hint": null,
      "default": 25000,
      "unit": null,
      "min": 0,
      "max": null
    },
    {
      "id": "programCost",
      "label": "Annual training program cost",
      "kind": "number",
      "hint": null,
      "default": 45000,
      "unit": null,
      "min": 0,
      "max": null
    }
  ],
  "outputs": [
    {
      "id": "roi",
      "label": "ROI",
      "format": "percent",
      "hint": null,
      "primary": true
    },
    {
      "id": "value",
      "label": "Estimated annual value of risk reduction",
      "format": "currency",
      "hint": null,
      "primary": false
    },
    {
      "id": "netBenefit",
      "label": "Net benefit (value − program cost)",
      "format": "currency",
      "hint": null,
      "primary": false
    },
    {
      "id": "phishesPrevented",
      "label": "Successful phishes prevented per year (est.)",
      "format": "number",
      "hint": null,
      "primary": false
    },
    {
      "id": "delta",
      "label": "Click rate reduction",
      "format": "percent",
      "hint": null,
      "primary": false
    }
  ],
  "worked_example": {
    "inputs": [
      "Phishing attempts received per year (est.): 5000",
      "Baseline click rate: 30",
      "Post-training click rate: 6",
      "Average cost of a successful phish: 25000",
      "Annual training program cost: 45000"
    ],
    "outputs": [
      "ROI: 66567%",
      "Estimated annual value of risk reduction: $30,000,000",
      "Net benefit (value − program cost): $29,955,000",
      "Successful phishes prevented per year (est.): 1,200",
      "Click rate reduction: 24%"
    ]
  },
  "how_to": {
    "title": "How to use this",
    "steps": [
      "Enter phishing attempts received per year (est.).",
      "Enter baseline click rate.",
      "Enter post-training click rate.",
      "Enter average cost of a successful phish.",
      "Enter annual training program cost.",
      "Read your roi on the right — it updates as you type.",
      "Hit Share to keep the scenario or send it to someone."
    ]
  },
  "scenarios": [
    {
      "name": "Conservative",
      "description": "Lower-end numbers — what if things land soft?",
      "values": {
        "attemptsYear": 3000,
        "baselineClick": 18,
        "trainedClick": 4,
        "costPerPhish": 15000,
        "programCost": 27000
      }
    },
    {
      "name": "Typical",
      "description": "Defaults — the most common real-world setup.",
      "values": {
        "attemptsYear": 5000,
        "baselineClick": 30,
        "trainedClick": 6,
        "costPerPhish": 25000,
        "programCost": 45000
      }
    },
    {
      "name": "Ambitious",
      "description": "Higher-end numbers — what if things really pop?",
      "values": {
        "attemptsYear": 8000,
        "baselineClick": 48,
        "trainedClick": 10,
        "costPerPhish": 40000,
        "programCost": 72000
      }
    }
  ],
  "limitations": [
    "Results are estimates before tax, fees, and inflation unless an input explicitly covers them.",
    "Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.",
    "This is educational maths, not financial advice. Check anything contractual with the lender or your accountant."
  ],
  "faq": [
    {
      "q": "How do I estimate 'phishing attempts received per year'?",
      "a": "Pull it from your email security gateway logs, most platforms report a count of messages classified as phishing or flagged and quarantined. If you don't have that visibility, a rough proxy is 3-8 phishing-classified emails per employee per year for a typical mid-size company, though targeted or high-profile organizations see much higher volume."
    },
    {
      "q": "Is a single click really worth $25,000?",
      "a": "It varies enormously by what the click leads to. A credential harvest that gets caught by MFA might cost near zero, while a business email compromise that leads to a fraudulent wire transfer averages well over $100,000 per FBI IC3 reporting, so use your own incident history or a conservative blended estimate rather than the worst-case number."
    },
    {
      "q": "Do click rates really drop that much from training alone?",
      "a": "Consistent monthly or quarterly simulated phishing combined with immediate, specific feedback (not generic annual compliance training) is what drives the drop; a once-a-year video module alone barely moves the needle. The gains documented across major awareness platforms come from repetition and real-time correction, not one-time content delivery."
    },
    {
      "q": "What's missing from this ROI calculation?",
      "a": "It doesn't count the downstream value of employees who don't click but do report suspicious emails, which speeds up detection organization-wide, nor does it count reduced help desk load from fewer credential reset and malware cleanup tickets. Both push real ROI higher than this conservative estimate."
    }
  ],
  "related": [
    "https://www.revenuelab.fyi/toolbox/mfa-rollout-roi",
    "https://www.revenuelab.fyi/toolbox/breach-cost-per-record",
    "https://www.revenuelab.fyi/toolbox/annualized-loss-expectancy"
  ],
  "license": "CC-BY-4.0",
  "citation": "RevenueLab — Phishing Training ROI Calculator (https://www.revenuelab.fyi/toolbox/phishing-training-roi)"
}