Why Phishing Training Fails And What Works Instead

Article

Click Rate Is A Vanity Metric

Most organizations run an annual simulated phishing campaign, record a click rate, and file the result. The number goes down slightly each year, everyone is satisfied, and the underlying risk is completely unchanged.

The problem is what the metric measures. A click rate tells you who was distracted on a Tuesday morning. It does not tell you whether people report suspicious messages, whether reporting is easy, or whether anything happens when they do.

Reporting rate is the metric that matters. An organization where thirty percent click but eighty percent report is far safer than one where five percent click and nobody says anything, because the second organization has no visibility into live campaigns targeting it.

What works: make reporting a single button in the mail client. Respond to every report, including false alarms, so people are not punished for caution. Run short, frequent, role-relevant training rather than one long annual module. And crucially, treat a click as a system failure rather than an individual one, because a single click should never be sufficient to cause a breach.