A phishing simulation can produce a neat percentage within minutes. The harder work is deciding what that percentage actually says about risk in your organisation. Phishing simulation results are useful when they lead to a clear action: better training, a safer reporting culture, or a more resilient business process. Used without context, they can become a scoreboard that unfairly labels staff as the problem.
For HR, IT, risk and compliance teams, the aim is not to catch people out. It is to understand how employees respond when a realistic-looking message arrives during a busy workday, then reduce the chance that a genuine attack succeeds.
A click rate alone is not a security culture assessment. Before interpreting results, return to the scenario and its purpose. Was the simulation testing whether staff notice suspicious links? Whether they verify an unexpected invoice? Whether they know how to report a suspected phishing email? Or whether a particular team is exposed to a credible business email compromise risk?
The answer changes what good performance looks like. A simulation designed around a fake Microsoft sign-in page may test credential awareness. A message impersonating a supplier may test invoice payment controls and verification habits. A parcel delivery lure may be relevant for a workforce that regularly receives deliveries, but less relevant to a team that rarely handles them.
This matters because phishing is rarely just an employee knowledge issue. A person may be distracted, under time pressure, using a mobile device, or following a process that encourages speed over verification. Results should prompt questions about the environment around the employee, not only the employee’s decision.
The most useful reports separate actions into stages. Looking at these stages together reveals where the real weakness sits.
For example, a 12 per cent click rate may sound concerning. But if most recipients reported the email promptly, and no one entered credentials, the organisation may have a responsive workforce with a specific recognition gap to address. Conversely, a low click rate with almost no reports can suggest employees are deleting suspicious messages without notifying the people who need to investigate them.
Consider timing as well. Reports made quickly are more valuable than reports made days later. In a real campaign, rapid reporting can allow IT or security teams to remove malicious messages, block domains and warn affected teams before the attack spreads.
Trend data is more valuable than a single campaign, but only when the simulations are comparable. A simple spelling-error email sent to all staff should not be measured against a carefully researched supplier impersonation sent to finance staff. Different lures, levels of personalisation, delivery times and audience groups create different levels of difficulty.
Track results over time by campaign type, department, role and risk exposure. Avoid publishing league tables or treating minor percentage changes as proof that a team is careless. Small groups can create misleading swings: one click in a team of ten is 10 per cent, while one click in a team of 200 barely shifts the figure.
A sensible approach is to look for repeated patterns. If employees regularly struggle with fake file-sharing notices, the learning need is clear. If finance staff respond to supplier payment requests, the issue may require both targeted education and a stronger call-back verification process. If new starters perform differently from established employees, include phishing awareness in induction and early refresher training.
Phishing simulations work best when staff know their organisation is trying to help them make safer decisions. Naming and shaming people who clicked can suppress reporting, create anxiety and encourage staff to hide mistakes. That is the opposite of what a security-aware culture needs.
Use aggregated results for organisation-wide reporting. Where follow-up is needed, keep it respectful and practical. A short, focused module on recognising suspicious sender addresses, unexpected requests or credential prompts is more useful than a generic warning to be more careful.
It is also worth examining why a lure worked. A message that appears to come from payroll near payday may exploit a normal workplace expectation. An urgent request from a senior leader may expose a culture where staff feel unable to question authority. These findings can inform training, but they can also inform operational controls. High-value payment changes, password reset requests and sensitive data transfers should have verification steps that do not rely on one person spotting every red flag.
Broad annual awareness training has a place, particularly for new starters and baseline compliance. However, simulation findings are most useful when they shape short follow-up learning that addresses the exact behaviour observed.
If people clicked links in messages relating to shared documents, focus on checking the sender, hovering over links where appropriate, and accessing documents through known systems rather than an email prompt. If staff entered credentials after a sign-in request, explain why legitimate services may be imitated and reinforce the value of multi-factor authentication. If reporting was low, show employees exactly how to report suspicious emails and what happens after they do.
Keep the learning close to the event. A short interactive microlearning module delivered soon after a campaign is easier to absorb than a lengthy course months later. It should use plain workplace examples and finish with a few clear actions employees can recall when they are busy:
For organisations using their own learning management system, SCORM-compliant modules make it easier to assign targeted content, retain completion records and include training in existing induction or refresher programs. This preserves control of delivery and reporting while avoiding the need to move employee data into another training platform.
No training program can guarantee that nobody will ever click a convincing phishing email. Attackers test real organisations, use familiar brands and exploit current events. The goal is to make one mistake less likely to become a serious incident.
Review phishing simulation results alongside technical and governance controls. Email filtering, multi-factor authentication, least-privilege access, secure payment approval workflows and incident response procedures all reduce the consequences of a successful lure. Clear policies also give employees confidence about what to do when a message seems suspicious.
There is a practical trade-off here. Highly realistic simulations may provide useful insight, but they can be inappropriate if they imitate sensitive events, cause distress or undermine trust. Set boundaries before each campaign. Do not use lures involving personal hardship, health matters or other topics likely to create unnecessary concern. Ensure the exercise reflects plausible business risk and that follow-up support is ready.
The strongest sign of progress is not necessarily a perfect click rate. It is a workforce that pauses, checks and reports quickly, combined with teams that respond constructively to those reports. Employees should understand that reporting a mistake early is always better than staying silent.
CybEssential’s downloadable awareness resources can support this approach by giving organisations practical, deployable training they can run through their existing LMS, on their own schedule. The value comes from using those resources as part of a continuing cycle: simulate a relevant risk, review the evidence, reinforce the right action and improve the controls around the work.
Treat every reported phishing email as useful intelligence. When employees see that their reports lead to clear action rather than blame, they become an active part of the organisation’s defences.
