In short: The Employee Security Index (ESI) is Hornetsecurity's benchmark for employee security behaviour. It scores how people respond to phishing simulations graded by attacker effort, compares the result with an 'exemplary' group, and uses the score to decide who needs more e-training. It is shown with history and forecast in the Awareness Dashboard.
What the ESI is
The Employee Security Index, or ESI, is the measurement at the centre of the Hornetsecurity Security Awareness Service. Hornetsecurity describes it as a benchmark that continuously measures and compares the security behaviour of employees across the organisation, and that manages each person's need for e-training. Hornetsecurity says the method for working it out is patented.
The point of the ESI is to turn a stream of simulation results into one number that means the same thing from month to month. That makes it easier to see whether your programme is working, to compare teams fairly and to explain progress to people who will never read a campaign report.
How the score is worked out
Hornetsecurity's ESI white paper sets out the method in broad terms:
- Phishing scenarios are sorted into seven levels according to how long a real attacker would need to prepare them, from a mass phishing email to a message about a project the recipient is working on
- Each employee receives randomly selected simulations from different levels, at random times
- Critical behaviour is recorded, such as clicking a harmful link or opening a file attachment
- Each level has a tolerance: the rate of critical behaviour that would still count as exemplary, given how hard that kind of attack is to spot
- The group's actual behaviour is compared with that exemplary standard to produce the index
On Hornetsecurity's published scale, a group that behaves exactly like the exemplary standard scores 90. Critical behaviour twice as often gives 80, three times as often gives 70, and anything below 70 is treated as critical. Because harder attacks carry a higher tolerance, people are not penalised as heavily for falling for a sophisticated lure as for a crude one.
How the ESI steers training
The ESI is not only a report. It drives the Awareness Engine, which rolls out e-training based on each user's level:
- People and groups whose behaviour is weaker receive more training, including the optional booster for those who need more intensive help
- People already at a very good level receive less, so they are not worn down by repetition
- New users can be enrolled automatically when directory synchronisation is in place, so gaps do not open up as people join
Hornetsecurity's own white paper argues that scores fall when training is paused and that they become harder to maintain as new employees join, which is why the service is designed to run continuously rather than as an annual campaign. That fits the NCSC's advice to treat awareness as an ongoing activity; see our page on NCSC guidance on staff training.
Reading the ESI in the Awareness Dashboard
Administrators see the ESI in the Awareness Dashboard alongside key figures for training groups and individual employees:
- ESI history: how the score has moved since the programme began
- ESI forecast: how the score is expected to change in future
- Key figures for training groups and individual employees, so you can see which teams sit above or below your target
- Training progress based on the ESI, so you can see whether e-training is closing gaps
Employees use the User Panel to reach their learning content and an evaluation of their own phishing simulations. We recommend sharing results with staff as personal feedback rather than as a league table of colleagues, which helps keep the programme blame-free. Our page on building a positive security culture explains why that matters.
Using the ESI in board and insurer reporting
A single, stable index is useful when you report upwards, but it should not be the only figure. A simple quarterly board summary might include:
| Measure | Why it matters |
|---|---|
| ESI trend and forecast | Shows the direction of travel, adjusted for how hard the tests were |
| Teams below your target ESI | Shows where extra training or process changes are needed |
| Report rate and time to report | Shows whether people are telling IT quickly, which limits damage |
| Training completion | Evidence for auditors and insurers that training happened |
| Actions taken | What changed as a result, such as a new payment verification step |
For more on choosing metrics, see how to measure security awareness training effectiveness. If an insurer asks for evidence of training, our page on security awareness training for cyber insurance lists what to keep. Boards can find wider guidance on cyber security training for board members.
How the ESI compares with other risk measures
Several platforms we supply now offer a headline risk measure. They measure different things:
| Measure | Platform | What it is based on |
|---|---|---|
| Employee Security Index | Hornetsecurity | Behaviour in phishing simulations graded by attacker effort |
| Predicted compromise rate | Attack Simulation Training | Historical Microsoft 365 data predicting the share of people a given payload is likely to compromise |
| Per-person risk score across four pillars | usecure uHealth | usecure training, phishing, policy and breach data plus Microsoft 365 or Google Workspace identity signals |
| Live per-user risk score | IRONSCALES | Simulation results, training outcomes and emails each person reports |
| Very Attacked People | Proofpoint Essentials | Which users real attackers target most |
None is better in every case. The ESI is strongest as a consistent view of behaviour under realistic attack. Our human risk management guide explains how these signals fit together, and Hornetsecurity vs Proofpoint Essentials compares the ESI with Very Attacked People in more detail.
Contact us to see the ESI and the Awareness Dashboard in a demonstration.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does a good ESI score look like?
On Hornetsecurity's published scale, a group that behaves like its 'exemplary' standard scores 90, and anything below 70 is treated as critical. We suggest agreeing a target and tracking the trend rather than chasing a single month's figure.
Is the ESI calculated for individuals or the whole organisation?
Hornetsecurity uses the ESI to measure behaviour across the organisation and to manage each person's training needs. The Awareness Dashboard shows key figures for training groups and individual employees alongside the ESI.
Why does the ESI weight attacks by difficulty?
Because a raw click rate depends heavily on how hard the test was. Grading scenarios by attacker effort and allowing a higher tolerance for harder attacks makes results comparable over time.
Can we show the ESI to our board?
Yes. The ESI history and forecast are a clear way to show progress. We recommend pairing it with report rate, completion and the actions you have taken, so the board sees behaviour as well as a score.