Phishing Simulations: What Most Companies Get Wrong

Most organizations run a phishing simulation, get a click-rate number, present it in a slide to leadership, and call the exercise done. That single number tells you almost nothing useful about your actual security posture.

What matters far more is what happens next: did employees report the simulated phishing email? How quickly? Did the same individuals fall for the same type of lure as last time? A single test without follow-up just creates a false sense of progress.

The programs that actually reduce risk treat simulations as a continuous learning loop. That means targeted micro-training immediately after someone clicks, recognition for employees who correctly report suspicious emails, and gradually increasing the sophistication of simulated attacks over time.

Mature programs eventually test spear-phishing scenarios that reference real internal project names or mimic actual vendor communication patterns — because that's genuinely what sophisticated attackers do once they've done basic reconnaissance on your organization.

Segmentation matters too. Finance teams handling wire transfers deserve more sophisticated, business-email-compromise-style simulations, since that's precisely the attack pattern most likely to target them.

One under-discussed aspect is measuring reporting behavior, not just click behavior. An organization where people click less but also report less is arguably worse off than one where more people click but far more also report — because the first has no early-warning system when a real attack eventually gets through.

The goal isn't a scoreboard number. It's building instinctive skepticism that survives a busy Monday morning and an urgent-sounding invoice email arriving right before a long weekend.\n\nLeadership buy-in matters more than most security teams initially realize. If executives visibly participate in training and openly discuss their own near-misses, it signals that reporting a mistake is safe and expected, not something to hide. Conversely, if security awareness is treated as a compliance checkbox that leadership itself skips or delegates, employees pick up on that signal quickly, regardless of what the official training materials say.\n\nMeasuring program effectiveness over quarters, not single tests, also matters. A single test's click-rate is noisy and can be misleading — a slightly harder-than-usual simulation or one that happens to land during a particularly busy week can produce a spike that looks like regression but is really just normal variance. Tracking trends across multiple simulations over 12-18 months gives a much more honest picture of whether your program is actually working.\n\nWe've also found that involving a small group of enthusiastic employees as informal 'security champions' within each department — people who help explain simulations to colleagues and model good reporting behavior — often does more for genuine culture change than any top-down mandate alone.\n\nWe've also seen real value in varying simulation delivery channels beyond email alone — SMS-based smishing simulations and even simulated phone-based vishing attempts, since attackers increasingly diversify their approach beyond email as awareness of email-based phishing has generally improved across most organizations.\n\nIt's also worth acknowledging that no awareness program, however well designed, reduces click rates to zero — and that's not actually the right goal to chase. Even highly trained security professionals occasionally click on well-crafted phishing attempts under the right combination of timing, urgency and context. The real measure of success is whether your organization can detect and contain the fallout quickly when someone inevitably does click, not whether you've achieved a theoretically perfect workforce that never makes a mistake.\n\nWorth adding: the timing and cadence of simulations matters more than most programs account for. Running simulations too frequently trains employees to expect them and become hyper-vigilant only during periods they suspect testing is happening, which doesn't reflect genuine behavior change. Running them too rarely means skills atrophy between tests. A cadence of roughly monthly, with unpredictable timing and varied templates, tends to produce the most honest signal about actual organizational resilience, while still giving enough frequency to build genuine habit formation rather than one-off vigilance spikes around known testing windows.