Accurately Measuring your Organizations Defensive Posture Against Phishing Attacks Phishing emails are the single most significant attack vector facing consumers and businesses today. Companies routinely report on metrics that do not adequately define their risk against these attacks. This paper covers a process to identify and produce metrics tailored to an individual company's posture against these attacks. The topics covered range from how to correctly measure a company's incident response towards phishing attacks to measuring and calculating an adversary's breakout time in a specific environment. The combined times create a clear and quantitative metric that security organizations can measure against and create a proper maturity plan. Garner, Michael Creator Palazzi, Bernardo Advisor Laverty, Patrick Advisor Brown University School of Professional Studies and Department of Computer Science Sponsor 2020 16 p. born digital Capstone (EMCS)--Brown University, 2020 Phishing Cybersecurity Metrics Gap time text Critical Challenge Project English In Copyright All rights reserved. Collection is open for research. 10.26300/q1ch-zz87