Do Phishing Simulations Actually Work? An Honest Look

Send a fake phishing email to your staff, count who clicks, report the number to management. It has become a standard part of security awareness, and the click rate has become the metric everybody quotes.

Which raises a fair question: do phishing simulations actually reduce the chance of a breach, or do they mostly produce a chart? The honest answer is that they can work well, and that a lot of programmes are set up in a way that guarantees they will not.

The click rate is the wrong number

Click rate is easy to measure, easy to graph and easy to move. That last part is the problem. Send an obvious test and the rate drops. Send something genuinely convincing and it climbs again, because with enough effort an attacker can fool almost anyone on a busy Tuesday.

A falling click rate can mean your staff are more alert. It can equally mean your phishing simulations got easier, or that people recognise the sending pattern, or that everyone has quietly told each other in the kitchen. None of that reflects real resilience.

The number worth tracking instead is the report rate: what proportion of people forwarded the suspicious message to someone. And, more useful still, how quickly the first report arrived.

Why reporting time beats clicking

Assume somebody will click. In a company of fifty, over a year, with a determined attacker, someone will. Your security cannot depend on nobody ever making a mistake.

What determines the outcome is what happens next. If the first report lands within three minutes, you can pull the message from other inboxes, reset the account and check for suspicious sign-ins before anything happens. If nobody says anything for two days, the attacker has had two days.

Measured this way, phishing simulations become a test of your detection and response, not a test of individual attentiveness. That is a far more useful thing to measure, because it is the part you can actually improve.

How to make phishing simulations backfire

There is a reliable recipe for making things worse, and plenty of organisations follow it without meaning to.

• Name and shame. Publishing who clicked, even lightly, teaches people that mistakes are embarrassing. The next person who clicks a real one says nothing.
• Punish repeat clickers. Linking results to performance reviews turns a safety exercise into a threat.
• Use cruel bait. Fake bonus announcements, fake redundancy notices, fake parcel problems during a difficult period. These get high click rates and destroy trust in internal email, which you need for everything else.
• Run one campaign a year. A single annual exercise measures a moment, not a habit.
• Skip the follow-up. A simulation with no explanation afterwards teaches nothing at all.

The common thread is fear. A security culture built on fear produces silence, and silence is exactly what an attacker needs.

What good phishing simulations look like

Announce the programme before you start. Tell everyone that simulations will happen, that results will never be individual, and that reporting is the behaviour you are looking for. You lose nothing by being open, because you are not trying to catch people out.

Make reporting effortless. One button in the mail client, not an instruction to forward a message to an address nobody remembers. Then respond to every report, even the false alarms, and thank the person. If reporting feels like shouting into a void, it stops.

Show the answer afterwards. A short message that says here is what we sent, here are the three details that gave it away, works better than any training module. Keep it free of blame and people will read it rather than skim it.

Vary the difficulty deliberately, run something small every month or two rather than one big annual exercise, and pair it with security awareness training that covers the attacks people actually meet, particularly requests to change bank details.

Where simulations cannot help

One important limit. No amount of training defeats a well-made attack that captures your password and your one-time code in real time. Modern phishing kits do this routinely, and the user often does nothing visibly wrong.

That is a technical problem needing a technical answer: phishing-resistant sign-in, so a stolen credential cannot be replayed elsewhere. Awareness reduces how often people get caught. Only the underlying setup decides what a successful catch is worth to the attacker. Treat phishing simulations as one layer among several rather than as the whole defence.

Let us run this properly

Done well, phishing simulations are a genuinely useful part of security. Done as a compliance box, they generate a report and a small amount of resentment.

At EvolvingDesk we run them the first way. We set up the reporting button, measure how fast reports come in rather than who clicked, keep results anonymous, and follow every campaign with a short explanation your team will actually read. Alongside that we handle the technical side, so a click does not become an incident.

You end up with staff who tell you when something looks wrong, which is worth more than any percentage on a slide.

Want to test how your team responds? Plan a call and we will set up a first campaign together.

Read more

• How to keep remote workers productive and secure
• The 3-2-1 backup rule explained
• Managed IT services at EvolvingDesk

Further reading: the NCSC guidance on phishing defence and the CISA phishing guidance.