Imagine two groups with the same click rate. In one, employees who suspect a message report it quickly, allowing the security team to investigate, detect other people who may have received it and warn other recipients. In the other, people delete the message or ignore it without reporting it. The click rates may look identical, but the organization’s ability to detect a real campaign is different.
Reporting rates and time to report therefore deserve more attention. Security teams should understand whether employees use the approved reporting channel, how quickly suspicious messages reach analysts and whether those reports lead to effective action. The National Cyber Security Centre’s guidance on phishing provides practical advice on recognizing and reporting suspicious messages and organizations should have this on their website or HR portals.
As I have seen in multiple simulations I have conducted, results also need careful interpretation. A test is a controlled exercise, not a guarantee of how someone will behave during a real attack, which could depend on the recipient’s state of mind. Employees may recognize familiar templates or learn the patterns used in repeated campaigns. Clicking a simulated link also does not automatically mean someone would compromise the organization in a real incident.
