The Phishing Simulation Results Deserve a Second Look

The phishing simulation report arrives, someone notes the click rate, and the number goes in a file. Eight percent clicked, same as last time. Meeting adjourned.

Read properly, that report is one of the richest sources the program has. It says which teams are struggling, which lures actually work on your people, and whether the training is changing anything at all. The glance-and-shrug wastes the only part of the exercise that was worth paying for.

Key takeaways

• The click rate is the least interesting number in the simulation report.

• Read by team, by lure and by trend: the patterns are where the program lives.

• The reporting rate matters more than the failure rate; silence is the real exposure.

• Use results to help the struggling teams, never to shame the individuals.

• What the report teaches should change the next simulation and the next training.

Step 1: Read past the headline number

The company-wide click rate averages away the information. Break the results down: which departments clicked, which reported, how fast. A program with a two percent click rate can still have one team at twenty, and that team is where your risk actually lives.

The same breakdown shows the bright spots: the team that reports in minutes is proof the culture can work, and a model for the rest.

Step 2: Ask which lures worked, and why those

The lure analysis is the report's most actionable page. If the fake shipping notice outperformed the fake IT alert three to one, your people's daily work shapes their blind spots, and the training should meet them there.

This fictional example shows the read. It is an illustration, not a prescription.

Step 3: Treat the reporting rate as the headline

The click rate measures the last mistake. The reporting rate measures the safety net: how many people, seeing something odd, said something. A company where a fifth of people report quickly can absorb the ones who click. A company where nobody reports is one click from a bad week.

The levers are boring and effective: a one-tap report button, a fast thank-you, and a visible record that reports get acted on. Alert fatigue is the same lesson from the other direction: signals die when nobody acts on them.

Step 4: Close the loop into the next campaign

The read is only worth what it changes: next quarter's lures tuned to what worked, coaching aimed at the struggling team, the reporting path shortened. Awareness ideas that outlast October has the formats that keep the material fresh when the same slide deck stops landing.

Frequently asked questions

What is a good click rate?

The trend matters more than the number: is it falling as training changes, and is reporting rising? Industry benchmarks exist but your own trajectory, by team and by lure, is the useful measure.

Should individuals who click be disciplined?

No. The moment clicking carries punishment, reporting stops and the real risk goes dark. Coach the team, make reporting safe and easy, and reserve individual follow-up for the rare repeat pattern, handled privately.

How often should simulations run?

Monthly or quarterly, varied in difficulty and theme, is common. Whatever the cadence, the second look at results is the step that cannot be skipped.

What if the results never improve?

Flat results across several campaigns mean the training is not reaching the behavior. Change the format, the messenger or the moment before blaming the audience. The year-end review of what awareness training actually changed takes that question on directly.

A Defensible Next Step

Pull the last simulation report and read it by team, by lure and by reporting rate. The next campaign should be designed by what you find. Book a Decision-Clarity Call if you want a second read on the results.