NIST also describes phishing as a social engineering technique that prompts the recipient to take an action that benefits the attacker, such as clicking on a fraudulent site or downloading a malicious attachment. In its definitions, phishing usually impersonates a trusted source, such as a bank, a credit card company, or a leader within the employee's own company.
To measure it in an HRM program, NIST suggests considering the human difficulty of detecting the message and the characteristics of its recipients through the NIST Phish Scale. That measurement makes it possible to move beyond raw click rates and better assess observed behavior.
NIST also treats phishing resistance as a property of the authenticator or protocol, based on cryptographic authentication, rather than as behavior that depends only on user vigilance. For that reason, it recommends combining phishing-resistant authenticators with awareness, training, email security, data loss prevention, and network security capabilities.
