Measuring phishing simulations: the metrics that matter

The core metrics

• Click-rate — the share of recipients who clicked the link. A starting point, not the goal.
• Submission-rate — those who went further and entered credentials or data. Closer to real-world harm.
• Report-rate — the share who reported the email as suspicious. The metric that most reflects a healthy security culture.
• Reporting speed — how quickly the first (and most) reports arrive. Fast reporting shrinks an attacker’s window.

The resilience ratio

A useful single view is the ratio of people who reported to those who clicked. As a programme matures, this ratio should climb — more reporters, fewer clickers — showing that your workforce is turning into an active sensor network rather than a liability.

Read trends, not snapshots

A single campaign’s numbers are noisy — they depend on the lure’s difficulty, timing and audience. Judge the programme by the trend across many campaigns with varied scenarios, not by one score. Beware "teaching to the test": if you always send easy lures, click-rate looks great and means nothing.

What to report to leadership

• Trends over time (click, submit, report, speed), not individuals.
• The resilience ratio and how it’s moving.
• Coverage — who has been trained and how recently.
• How results map to risk and to obligations such as NIS2 awareness requirements.