Phishing Simulation Fails: Why Click Rates Alone Mislead You

A quarterly phishing simulation report lands on your desk. The click rate dropped again. Leadership is pleased, and someone asks whether the training has finally worked.

Maybe it has. Maybe it hasn’t. The click rate alone cannot tell you.

Most security teams track one number from every phishing simulation: the percentage of employees who clicked. It is easy to collect and easy to chart. It also fits neatly on a slide. Those strengths explain why it became the default metric, and why it so often misleads. This article explains what click rates measure, where they fail, and what to track instead.

What a Phishing Simulation Click Rate Really Measures

A click rate measures one thing: how many people clicked a specific link in a specific email on a specific day. That is a narrow snapshot. It says nothing about why they clicked or what they would have done next.

It also says nothing about the people who did not click. Some of them spotted the attack and reported it. Some never saw the email. Some were on leave, in meetings, or filtering messages to a folder they check twice a week. The click rate treats all of them the same.

Think of it like a smoke detector test that only counts how many people walked toward the exit. You learn something, but not whether the building is safe. You do not know who noticed the alarm, who ignored it, or who called the fire department.

A click rate is a lagging indicator of one behavior. It was never a measure of resilience. Treating it as one is where the trouble starts.

Five Ways a Low Click Rate Can Lie to You

A falling click rate feels like proof of progress. Several quiet factors can produce it without any change in actual risk. Here are the five most common.

1. The Templates Got Easier

Every phishing simulation platform offers templates with different levels of difficulty. A fake prize notification is easy to spot. A message that references a real vendor, a real project name, and a realistic deadline is hard to spot.

If your team drifts toward easier templates, the click rate falls. Nobody planned it. A busy administrator reuses what worked last time, or avoids a campaign that might upset a department head. The metric improves while the training stands still.

2. Employees Learned the Test, Not the Threat

People are good at pattern matching. If every simulation arrives on a Tuesday morning from the same sending domain with the same banner, employees learn to recognize the exercise. They stop evaluating the message.

Real attackers do not send on a schedule. They send when you are distracted, when payroll closes, or when a major vendor announces a change. An employee who avoids your test emails may still fall for a real one.

3. Delivery Problems Hide in the Data

Some simulated emails never reach the inbox. Spam filters catch them. Security gateways rewrite the links. Mobile mail clients preview content in ways that break tracking.

If the email never appeared, nobody could click it. The report counts that as a success. Teams rarely audit delivery, so a technical failure can pass as a behavioral win.

4. The Sample Is Too Small or Too Uniform

A campaign sent to 40 people in one department tells you about that department on that day. If the click rate drops from 15 percent to 10 percent, you may be looking at two people. Small samples swing wildly.

Uniform sampling causes a different problem. If you always target the same groups, you miss the contractors, new hires, and executives who attackers prefer.

5. Clicking Is Not the Same as Compromise

Many simulated attacks end at the click. Real attacks do not. A link that opens a login page matters only if the employee enters credentials. An attachment matters only if they enable macros or run the file.

A report that lumps a casual click together with a full credential submission hides the difference. Those are two very different outcomes. The first is a curiosity. The second is an incident.

The Reporting Gap Most Programs Ignore

Here is the question most phishing simulation dashboards cannot answer: how many people told you about the email?

Reporting is the behavior you actually want. An employee who spots a suspicious message and forwards it to the security team has done more than avoid a mistake. They have turned themselves into a sensor. That one report can help you find and remove the same message from forty other mailboxes before anyone clicks.

A click rate gives you no credit for that. A program with a 5 percent click rate and a 2 percent report rate is in worse shape than one with an 8 percent click rate and a 40 percent report rate. The second program has people watching and speaking up. The first has people who are quiet, for reasons you do not know.

Silence can mean several things. The employee may not have noticed the email. They may have noticed and decided it was not their job to say anything. They may not know how to report it. They may fear that reporting will draw attention to them.

Each of those causes needs a different fix. The click rate cannot tell them apart.

Report rate and report speed deserve equal billing on the dashboard. The faster someone reports a real phish, the smaller the window for damage.

A Realistic Scenario: The Clean Report That Preceded a Real Incident

Consider a composite example drawn from the kind of pattern security teams describe often. A regional logistics company with about 600 employees runs monthly phishing simulations through its IT provider. Over a year, the click rate falls steadily. The quarterly report shows a clean downward line, and the managing director mentions it at a board meeting.

Behind the chart, three things have changed. First, the provider shifted to a small library of templates after complaints from the operations team about “tricky” tests. Second, the campaigns now go out at the same time every month. Third, nobody tracks reports, because the reporting button was never deployed to the mail client.

In the fourth quarter, an accounts payable clerk receives an email that looks like a routine update from a freight carrier the company uses daily. It references a real shipment number scraped from a public tracking page. It asks her to confirm new banking details through a link.

She does not click, in the sense the simulation platform measures. She opens the message, reads it, and replies to the sender asking for clarification. The attacker answers within minutes with a polite, convincing explanation. She then updates the vendor record, and a payment of a few weeks of freight charges goes to the wrong account.

None of this would have appeared in the click rate. There was no suspicious link to click in the second stage. The attack worked through conversation. Her training had taught her to avoid links and attachments. It had not taught her to question a request to change payment details.

When the finance team investigates, they find something uncomfortable. She had received two earlier simulations that year and passed both. By the numbers, she was a low-risk employee. By the standard of the attack that mattered, she had never been tested.

This is the core problem. Click rate rewards avoiding one narrow trick. Attackers have many tricks.

The Metrics That Tell You More Than Clicks

If the click rate is incomplete, what should you track? No single number replaces it. A small set of metrics together paints a more honest picture. Here are the ones worth adding.

Report rate. Measure the share of recipients who flagged the simulated email through your reporting channel. Track it by department and over time. A rising report rate shows growing awareness and trust in the process.

Time to report. Measure the minutes between delivery and the first report. In a real attack, this number decides whether you contain the message or chase it. Fast reporting is a skill you can train.

Credential submission rate. Separate the people who opened the landing page from the people who entered a password. The second group represents real exposure. Treat the two groups differently in both analysis and follow-up.

Repeat clicker patterns. Look at who clicks more than once across several campaigns. A small group often accounts for a large share of the failures. These employees may need different support, such as role-specific coaching or a closer look at their workload.

Click rate by difficulty. Report results by template difficulty. A 3 percent click rate on an obvious fake and a 25 percent click rate on a targeted one tell a very different story than a single blended average.

Segmented results. Break results down by department, seniority, location, and tenure. Finance, HR, and executive assistants face more targeted attacks than most teams. New hires often have the least context. Averages across the whole company bury these differences.

Trend over multiple campaigns. One campaign is noise. Six campaigns are a trend. Judge progress across quarters, not across a single send.

Real-world reports. Count how many suspicious emails employees report outside of simulations. This is the strongest signal you have. If real-world reports rise while real incidents fall, the program is working.

You do not need all of these on day one. Start with report rate and credential submission rate. They change the conversation faster than anything else.

Designing Phishing Simulations That Reflect Real Attacks

Better metrics only help if the simulations behind them are realistic. A weak test produces weak data, no matter how carefully you analyze it.

Start with the threats your organization actually faces. A manufacturing firm should expect invoice fraud, supplier impersonation, and fake shipping updates. A professional services firm faces credential theft, fake document sharing, and meeting invitations. Pull your template choices from your own incident history and your industry’s common patterns.

Vary the technique, not only the topic. Real attackers use more than links. They use attachments, QR codes, fake login portals, reply-chain hijacking, and phone follow-ups. A program that tests only link clicks prepares people for only one of those.

Vary the timing. Send campaigns on different days and at different hours. Include periods when people are tired or busy, such as the end of the month or the Friday afternoon rush. Attackers choose those moments on purpose.

Tier the difficulty. Run a mix of easy, moderate, and hard scenarios across every campaign cycle. Start new hires with simpler tests and build up. Give experienced staff harder scenarios that reflect targeted attacks.

Avoid tricks that damage trust. Fake bonus announcements, fake layoff notices, and fake health scares may produce high click rates. They also make employees angry at the security team. That anger costs you reports later. Realistic does not mean cruel.

Finally, deliver feedback right away. When someone clicks, show them a short explanation of what they missed. Keep it specific and respectful. A two-minute lesson at the moment of the mistake teaches more than a mandatory course six weeks later.

Culture Decides Whether Any Metric Means Anything

Every number on your dashboard depends on how employees feel about the program. If people fear punishment, they will hide mistakes. If they trust the process, they will speak up.

Consider what happens when a team publicly ranks departments by click rate. Managers react by pressuring staff to avoid clicking. Some employees stop opening unfamiliar emails at all, including legitimate ones. Others quietly delete suspicious messages instead of reporting them, because reporting a phish feels like admitting they saw it.

Both reactions improve your click rate. Both make your security worse.

A healthier approach treats mistakes as data. When an employee clicks a real phishing link, you want them to tell you within minutes. That only happens if past clickers were thanked, not shamed. Security teams that reward fast reporting, even after a click, see better outcomes in real incidents.

Leaders set this tone. If executives treat the phishing simulation as a gotcha game, staff will too. If executives share their own near-misses, staff feel safe doing the same.

Positive reinforcement also works. Recognize teams that report quickly. Share anonymized stories of real catches. Make the security team approachable, not feared.

None of this is soft. It directly shapes the quality of your detection data.

Where Simulations End and Exposure Begins

Even a perfect phishing simulation program has limits. It measures how employees behave inside your controlled tests. It does not show you what attackers already know about your people.

Credentials leak constantly. Employees reuse passwords across personal and work accounts. A breach at an unrelated service can expose a corporate email and password pair. Attackers collect these pairs, test them against corporate logins, and sell them in bulk. Your staff may never click a single phishing link and still have working credentials circulating online.

This is a gap that click rates cannot see. A user with a flawless record in your simulations may have a leaked password sitting on a criminal marketplace right now.

Dark web monitoring addresses that gap. It watches for your domains, email addresses, and credential pairs in known breach data and criminal forums. It does not stop every attack, and it will not find everything. It does give you an early warning, so you can force a password reset before someone uses the stolen login.

Treat the two functions as complementary. Simulations show how people behave under pressure. Exposure monitoring shows what attackers already hold. Together they give you a more complete view of risk than either provides alone.

What Security Teams Can Do This Quarter

You do not need a new budget to improve your program. You need a few deliberate changes. Use this checklist as a starting point.

Audit your current program.

• Review the last six campaigns. Note which templates you used and how difficult they were.
• Check delivery. Confirm that simulated emails reached inboxes across all mail clients and devices.
• Identify who has never been tested, including contractors, executives, and recent hires.

Fix your measurement.

• Add report rate and time to report to every campaign summary.
• Separate clicks from credential submissions and attachment executions.
• Report results by difficulty tier and by department, not as one blended number.

Make reporting easy.

• Deploy a one-click report button in your mail client if you have not already.
• Confirm that every report gets a quick acknowledgment, even a short automated thanks.
• Track real-world reports alongside simulated ones.

Improve the simulations.

• Build a template library from your own incident history and industry threats.
• Mix link, attachment, QR code, and conversation-based scenarios.
• Randomize send times and days.

Strengthen follow-up.

• Give instant, specific feedback after every click.
• Offer short targeted coaching to repeat clickers, without public ranking.
• Recognize fast reporters and share real catches.

Close the exposure gap.

• Check whether your staff’s credentials appear in known breach data.
• Enforce password resets and multi-factor authentication where exposure appears.
• Review how payment change requests are verified, since some attacks never involve a click.

Pick two or three items and finish them before adding more. Small, completed changes beat a large plan nobody finishes.

How to Explain Better Metrics to Leadership

Changing your metrics means changing the story you tell executives. That conversation takes some care.

Start by acknowledging what the old number did well. The click rate gave you a baseline and a simple trend. Then explain its limits using an example that feels familiar, such as the logistics scenario above. Executives understand that one number can hide a lot.

Next, introduce two or three new measures in plain language. Report rate shows how many employees act as an early warning system. Time to report shows how quickly you can contain a threat. Credential submission rate shows real exposure.

Expect the new numbers to look worse at first. Report rates are often low when you start measuring them. Credential submission rates may be higher than the click rate suggested. Warn leadership in advance. Frame the dip as a more accurate picture, not a decline in performance.

Finally, tie the metrics to outcomes the business cares about. Faster reporting means smaller incidents. Fewer credential submissions mean fewer account takeovers. Better coverage means fewer surprises. Executives fund what they understand, and they understand risk reduction.

How Cruxroot Fits Into a Better Program

The problems above share a common cause. Most programs treat simulation, training, and exposure as separate activities with separate reports. A more useful approach connects them.

Cruxroot is a security awareness platform built around that idea. It combines phishing simulations, dark web monitoring, and gamified employee training in one place. Your MSP partner can deploy and manage it for your organization, so your team does not carry the full operational load.

The phishing simulations support varied templates, difficulty tiers, and reporting metrics beyond clicks. You can see report rates and time to report alongside click data, and segment results by team. That gives you the fuller picture described in this article.

Dark web monitoring watches for your organization’s credentials in breach data and criminal marketplaces. When it finds exposure, you can act before an attacker does. It adds context that simulations alone cannot provide, though no tool catches everything.

The gamified training keeps employees engaged between campaigns. Short challenges and recognition for good reporting habits reinforce the behaviors you want. The goal is steady practice, not a once-a-year compliance course that people forget by March.

No platform replaces good process or good culture. Tools support a program. They do not substitute for clear ownership, honest metrics, and leadership that treats reporting as a strength. If you are reviewing your current setup, your MSP partner can walk you through how Cruxroot maps to the gaps you find.

Conclusion

Click rates are not useless. They are incomplete. Used alone, they reward easy templates, predictable schedules, and silent employees. They hide the behaviors that matter most in a real attack.

A stronger phishing simulation program measures reporting, speed, and real credential exposure. It uses varied, realistic scenarios. It builds a culture where people speak up quickly. It also looks beyond the simulation to what attackers may already hold.

Start small. Add report rate to your next campaign summary. Review your template difficulty. Check delivery. These steps cost little and change what your numbers mean.

The goal is not a prettier chart. The goal is a team that notices threats and acts on them fast.

Check our latest the blog regarding Password Managers vs. Passkeys: What Should Employees Actually Use?