<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-phishing-trends-and-metrics
description: >-
  Collect, analyze, and visualize phishing defense metrics including
  detection rates, response times, user reporting rates, campaign trends,
  and risk scores to drive data-informed security program improvements.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - phishing-metrics
  - trend-analysis
  - kpi-dashboard
  - reporting
  - risk-scoring
  - executive-reporting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Analyzing Phishing Trends and Metrics

## Overview

Effective phishing defense requires continuous measurement. This skill covers
defining KPIs, collecting metrics, building trend analysis, and generating
executive dashboards.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `pandas` | `pip install pandas` — data analysis |
| SIEM/SEG data exports | CSV or JSON metric dumps |

## Key Concepts

### Core KPIs

| KPI | Formula | Target | Frequency |
|---|---|---|---|
| Detection Rate | Detected / Total | > 95% | Monthly |
| MTTD | Avg(detect - delivery) | < 5 min | Monthly |
| MTTR | Avg(contain - detect) | < 15 min | Monthly |
| User Report Rate | Reports / Total | > 60% | Quarterly |
| Simulation Click Rate | Clicks / Sent | < 5% | Quarterly |
| False Positive Rate | FP / Alerts | < 10% | Monthly |

## Workflow

### 1. Collect Metrics

```bash
node agent.js collect --gateway-log /tmp/seg.csv --siem-log /tmp/siem.csv \
  --simulation-log /tmp/gophish.csv --output /tmp/metrics.json
```

### 2. Calculate and Compare KPIs

```bash
node agent.js calculate-kpis --metrics /tmp/metrics.json --period 2026-Q1
node agent.js compare-periods --metrics /tmp/metrics.json --period1 2025-Q4 --period2 2026-Q1
```

### 3. Analysis and Reporting

```bash
node agent.js trend-analysis --metrics /tmp/metrics.json --dimension time_series --window 12m
node agent.js risk-score --metrics /tmp/metrics.json --dimension department
node agent.js executive-report --metrics /tmp/metrics.json --period 2026-Q1 --output /tmp/report.json
node agent.js board-metrics --metrics /tmp/metrics.json
```

## Detection

```yaml
title: Phishing Trends And Metrics Detection
id: a665ae6d-46c9-47ba-88a0-80bc65a3c2d2
status: experimental
description: Detects suspicious activity related to analyzing phishing trends and metrics techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Metrics collected | Aggregated JSON contains all sources |
| KPIs calculated | All core KPIs have values |
| Trends identified | Direction determined |
| Executive report produced | Summary with findings |

## References

- [SANS Security Awareness Report](https://www.sans.org/security-awareness-training/reports/awareness-report/)
- [Verizon DBIR](https://www.verizon.com/business/resources/reports/dbir/)
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
