What methods can be used to determine employees' susceptibility to phishing attacks?

The following methods are used to determine employees' susceptibility to phishing attacks:

• Phishing simulations — organizing controlled phishing campaigns to check how many employees open suspicious emails or click on malicious links.
• Training tests and surveys — conducting tests on recognizing phishing signs and surveys about employees' experience and awareness.
• Incident analysis — studying real cases of phishing attacks within the company to identify vulnerable groups.

An example of a phishing simulation: sending an email requesting to update a password via a fake website, while recording the number of clicks and entered data.