Click Rate Isn't Enough: The Phishing Simulation Metrics That Actually Predict Risk

Click-through rate is the metric every security awareness vendor leads with, and it's the least predictive one we track. A low click rate can mask serious underlying risk if it's driven by a handful of highly sophisticated simulations that don't reflect what real attackers actually send.

The metric we weight most heavily is report rate — the percentage of employees who not only avoid clicking but actively report the simulated phish to security. A workforce with a low click rate but also a low report rate is one where employees are simply not engaging, not one that's actually vigilant. High report rate is the leading indicator that your security culture, not just your training completion numbers, is working.

Second is time-to-first-report, which tells you how quickly a real phishing campaign would reach your security team versus how long it would silently spread. Third is repeat-failure rate among the same individuals — a small population of repeat clickers, often in finance or executive roles, represents disproportionate risk and needs targeted intervention rather than another round of generic training. Fourth is credential-entry rate specifically, distinct from click rate, since clicking a link is recoverable but entering credentials on a fake page is not.

We build reporting around all five metrics for every client program, because a board slide that only shows a declining click-rate trend can create false confidence. Real risk reduction shows up across report rate, time-to-report, repeat-failure concentration, and credential-entry rate moving together in the right direction.