A low click rate can mean people are careful, or that the simulation was easy. What protects an organization is how fast someone reports a suspicious message, not how many people ignored it.
Why click rate misleads
Click rate is easy to measure and easy to lower: send more obvious simulations. The number improves while the organization stays exactly as exposed as before.
It also frames the exercise around failure. The person who clicked becomes the result. That is the opposite of what builds a team that reports early.
In a real incident, one early report is worth more than a hundred people who simply did not click.
What to measure instead
- Report rate. How many people flagged the message through the channel you gave them.
- Time to first report. How long until the security team heard about it. This is the number an attacker races against.
- Report after click. Someone who clicked and then reported within minutes did the most important thing right.
- Trend over time. The same people, over several exercises, with difficulty that goes up rather than down.
Designing it with care
A simulation is a practice, not a trap. It is agreed in scope before it runs, uses lab domains and never collects real credentials. Results are shared in aggregate, and the conversation afterwards is about how the message worked, never about who fell for it.
- Scope and authorizationAgreed first
- Real credentials collectedNever
- Individual results sharedNo, aggregate only
- Reporting channelOne click, visible
- Learning after each exerciseShort, specific
The goal is not a team that never clicks. It is a team that tells you in time.