Phish Scale is a NIST-oriented way to interpret phishing simulation results with context, rather than relying only on the raw click rate. A click rate tells you how many people clicked a test message, but it does not show whether the lure was obvious, how believable it looked, or whether users reported it instead of interacting with it. Phish Scale helps defenders compare campaigns more fairly by factoring in message difficulty and user response patterns.
This matters because phishing awareness programs are meant to measure behavior, not just punishment. In real defenses, a low click rate is encouraging, but it can hide problems such as poor reporting, weak credential hygiene, or uneven results across departments. In attacks, the same logic applies in reverse: a convincing lure can succeed even against trained users if the message is tailored well enough. Phish Scale gives security teams a better way to track whether training, simulations, and reporting channels are actually improving human resistance over time.