Click rate on a phishing simulation is easy to collect and easy to misread. A better set of measures tracks how fast people report, how many report after clicking, and whether harder tests are still being caught. Use the click rate as one input, never as the headline.
Why click rate misleads
A drop in click rate can mean people got better. It can also mean the test email was easy, the send was timed on a holiday, a filter blocked it, or staff learned to spot your template. Because each campaign differs, comparing last quarter to this quarter is rarely a controlled comparison.
It also rewards the wrong behavior. If a team is scolded for clicking, it will hide mistakes, and your real incidents will arrive later.
Metrics that help
- Time to first report. Minutes from send to the first person reporting. Faster is better, and it maps to real incident response.
- Report rate. Share of recipients who reported, regardless of whether they clicked.
- Report after click. People who clicked and then told you. This is a sign of a healthy culture, so treat a rise as good news.
- Repeat clicks. Look at the same people over several tests, then offer support instead of punishment.
- Credential entry versus click. Entering a password is a more serious event than opening a link.
Keep difficulty visible
Tag every campaign with a difficulty level, such as generic, themed to your company, or targeted at a role. Report results per level. A flat click rate on a harder test is progress.
Avoid vanity comparisons
Do not rank departments publicly. Do not compare your numbers to a vendor average without knowing how the vendor built it. Do not tie the results to performance reviews. The OWASP Security Culture project says its own culture survey results should never be used for hiring, promotion, performance review, discipline or access control, and the same caution fits simulation data.
Pair simulations with something real
Teach what to do, not only what to avoid. A short note after each test explaining the tells in that specific email works better than a generic course. Then check whether reporting improved next time.
What to tell leadership
One page: median time to report, report rate, report after click, and one sentence on what changed because of the data. Add one real incident or near miss where a report helped.
Quick check
What is a good click rate target?
There is no universal target worth quoting. Track your own trend by difficulty level and focus more on reporting speed and report rate.
Should repeat clickers be disciplined?
Usually no. Offer coaching and check whether tooling, such as phishing resistant sign in, can reduce the harm of a click.
Sources
Last reviewed: 19 October 2026.
