You can lower the click rate by frightening people. What you want is people reporting fast, and most programmes are measuring the wrong one of those.
Phishing simulation is one of the few security controls that acts on people rather than systems, which makes it unusually easy to do badly. A programme can produce excellent numbers while making the organisation less safe, and the mechanism is straightforward: you can lower the click rate by making people afraid of email, and afraid people do not report things.
The metric to manage
Report rate, and time to first report. Not click rate.
Here is why. In a real campaign, some people will click. That is going to happen in any organisation of any size, and no programme gets it to zero. What determines whether a click becomes an incident is whether somebody tells you, and how fast.
If ten people receive a phishing email, two click, and one reports it within four minutes, you can revoke sessions and reset credentials before anything happens. If nobody reports because reporting is awkward or because people fear being named, you find out when the invoice payment goes to the wrong account.
Click rate measures exposure. Report rate measures your actual capacity to respond. Manage the second.
Make reporting trivial
One button in the mail client, and an immediate acknowledgement when it is pressed. Both halves matter.
The acknowledgement is the part people skip, and it is why report rates plateau. If somebody reports a suspicious email and hears nothing, they learn that reporting goes into a void, and they stop. A short automated response, followed by a human note when it was a genuine threat, keeps the behaviour alive.
Thank people for false alarms, explicitly and without qualification. The cost of reviewing a legitimate newsletter somebody found suspicious is two minutes. The cost of the culture where people do not report because they worry about looking foolish is considerably higher.
What to simulate
Simulate what actually targets your organisation, which is almost never the generic prince-with-an-inheritance template.
For most businesses that means: a payroll change request appearing to come from an employee, an invoice with changed bank details from a known supplier, a fake multi-factor prompt or an authentication page, a shared document notification, and an urgent request appearing to come from a senior person.
The second and the last are the ones that cause actual losses. Simulating them is uncomfortable because they are effective, and that is the argument for doing it.
Where programmes quietly backfire
Three worth expanding.
Publishing individual results. Leaderboards, naming repeat clickers, or making results visible to managers. This reliably reduces clicks and reliably reduces reporting, because the person who clicked now has an incentive to say nothing and hope. That is precisely the outcome you cannot afford.
Disciplinary consequences for a simulated click. Same mechanism, stronger. If clicking has consequences, the rational response to having clicked is silence.
Simulations about bonuses, redundancy or bereavement. Real attackers use these, which is the argument for including them. The counter-argument is that a simulation telling staff they are at risk of redundancy causes genuine distress, and the goodwill cost usually exceeds the training value. Our view is to avoid the three above and simulate hard in every other direction. If you do use emotionally charged lures, tell leadership first and expect complaints.
Frequency
Monthly is too often for most organisations. It trains people to treat all internal mail with suspicion, which has real productivity costs, and the marginal learning after the first few is small.
Quarterly, with everybody included, works well. Add targeted exercises for high-risk groups: finance, anyone who can change payment details, executives, and anyone with administrative access. Those groups can reasonably see something monthly because they are the ones actually being targeted.
Training at the moment of the click
When somebody clicks, what they see next is the highest-value training the programme delivers, because they are paying full attention for about fifteen seconds.
Use it properly. A short page that says, without scolding, what the clues were in that specific email, and what to do next time. Thirty seconds of relevant explanation at the moment of the mistake outperforms a thirty-minute module two weeks later by a wide margin.
Then, if the person clicks again in the next cycle, a conversation rather than an escalation. Repeat clickers are usually people under time pressure doing a high-volume job, not people who do not care, and the fix is often a process change rather than more training.
Reporting to leadership
Three numbers on one slide, quarterly:
Report rate, trending. The headline.
Median time to first report. This is the number that predicts incident cost, and it should be falling.
Click rate, as context rather than as the headline, with no names.
Then one sentence on what changed as a result. If the answer is nothing, the programme is a measurement exercise.
The thing simulation cannot fix
A sufficiently good phishing attack will succeed against attentive, well-trained people. Targeted attacks using real context, correct tone and a genuine transaction in progress are not distinguishable by vigilance alone.
Which means simulation is one layer, and the layers underneath it matter more: phishing-resistant authentication so a stolen credential is not enough, alerting on mailbox rule creation, and a payment verification process that does not depend on anyone spotting anything. We wrote about those in email security.
Train people so they report quickly. Build the technical controls so that the one who does not report has not cost you the business.
