Phishing simulation is one of the few security controls aimed directly at people, which makes how you run it as important as whether you run it. Run badly, it damages trust and produces worse outcomes than not running it at all.
Click rate is the wrong headline metric
A sufficiently convincing phish will catch almost anyone on a bad day, and you can drive click rate to near zero by sending only obvious lures — which tells you nothing. Click rate also measures the wrong thing: you cannot achieve zero, so a programme built on it is built on an unreachable target.
Report rate is the metric that matters
The question that determines whether a real phish becomes an incident is: how quickly does somebody tell security? A reported phish at minute three lets you pull the message from every other inbox before it is opened. An unreported one gives the attacker hours.
Track report rate, and track time-to-first-report. Those numbers are improvable, and improving them genuinely reduces risk.
Never punish the click
Organisations that name and shame, or escalate to managers, reliably see reporting collapse. Staff who click and fear consequences stay quiet, and quiet is exactly what the attacker wants. People who report late because they were afraid cost you the window in which you could have contained it.
The person who clicked and immediately reported should be treated as having done the right thing — because they did.
Designing simulations worth running
- Use realistic lures. Model what is actually landing: delivery notifications, mobile-money alerts, payroll and HR notices, invoice and supplier changes.
- Vary difficulty. Mix obvious and genuinely hard. The hard ones tell you where your real exposure is.
- Segment by role. Finance gets invoice fraud. Executives get targeted lures. HR gets the CV attachment.
- Teach at the moment of the click. A short page showing the three signals in that message, not a twenty-minute module next quarter.
- Make reporting trivial. One button in the mail client. Any friction and it will not be used under time pressure.
What good looks like
After a year of a well-run programme, expect report rate climbing steadily, time-to-report falling toward minutes, and — the real prize — staff reporting genuine phishing attempts that your gateway missed. At that point your workforce has become a detection layer, which is what the exercise was always for.