Why Your Phishing Click Rate Tells The Board Nothing Useful

Click rate fools boards because it measures whether someone clicked a synthetic email once, not whether your organisation would catch, report, or contain a live attack. After fifteen years running security awareness and human risk programmes, I have watched click rate fall while incidents climbed, and boards never learned why.

Why does click rate fool boards?

Click rate fools boards because it collapses an entire year of behavior into one number generated by a single synthetic email. A board sees ‘click rate: 8%’ and reads it as a report card, when that number is highly sensitive to which template was sent, which department received it, what day of the week it arrived, and which device received it. I have watched the same population score 4% on a generic delivery-notice test and 22% on a well-targeted invoice-fraud test sent from a spoofed finance address, with no change in the underlying culture between the two tests. Verizon’s 2026 Data Breach Investigations Report found the human element present in 62% of breaches, up from 60% the year before according to Abnormal AI’s analysis of the report, with social engineering alone accounting for 16% of breaches per a separate review of the same DBIR data. The same report found engagement with mobile-based phishing simulations ran 40% higher than email-based ones, a detail covered by Help Net Security’s summary. A single percentage cannot carry that much variance, so it doesn’t.

What should you measure instead?

The four numbers worth reporting are reporting rate, median time-to-report, click-to-report ratio, and repeat-clicker concentration. Reporting rate tracks what share of a population used the report button rather than ignoring or clicking the email, which is the behavior a programme should try to increase. Proofpoint’s State of the Phish research found only 18.3% of simulated phishing emails were reported properly, and separately that 71% of working adults admitted to a risky action such as reusing a password or clicking a link from an unknown sender. Median time-to-report counts for more than whether someone reported at all, because a report arriving three days later cannot stop a live campaign already in progress. Click-to-report ratio and repeat-clicker concentration show where a population’s judgment breaks down under a well-crafted lure, which is exactly where an attacker finds success first.

Five metrics ranked by earliest warning

Ranked from earliest warning to latest confirmation, these five metrics are not equally useful to a security team:

1. Time-to-report. A report arriving within minutes gives a security team a live chance to block a campaign before it spreads past the first few recipients.
2. Reporting rate trend. A department-level drop in reporting across consecutive quarters tends to precede an incident by weeks, since it shows attention eroding before anyone exploits it.
3. Repeat-clicker concentration. A small group that clicks on nearly every simulation is the group most likely to click on a well-targeted live lure, so this number identifies where to focus training before an incident, not after.
4. Click-to-report ratio. This shows whether a population defaults to reporting or to clicking when it cannot tell whether an email is legitimate, which is the exact decision point inside a live attack.
5. Click rate. This only confirms, after the simulation has already run, whether that specific template would have worked. It carries no information about what the population will do with a different lure next week.

Has AI broken the click-rate model?

AI has broken the click-rate model because generative tools now write phishing emails with the grammar, tone, cadence and internal references of a genuine colleague, closing the gap between a well-built simulation and a well-built attack. Proofpoint’s 2026 AI and Human Risk Landscape Report found 42% of organizations had already experienced a suspicious or confirmed AI-related incident, even though 87% had deployed AI assistants beyond a pilot stage. The same research, covered in Proofpoint’s own analysis and by Industrial Cyber, found email remains the most common threat vector at 63%, while exposure spreads across third-party SaaS and cloud apps at 47%, social and messaging platforms at 41%, and AI assistants or agents themselves at 36%. Gartner predicts AI applications will drive 50% of cybersecurity incident response efforts by 2028, per its March 2026 forecast, and separately that 25% of enterprise generative AI applications will have at least five minor security incidents a year by 2028, per its April 2026 release. Click rate was built for a world of typo-ridden templates and was never designed to measure this.

What counts as a good reporting rate?

A good reporting rate is one that keeps climbing quarter over quarter, not a single benchmark to hit once and forget. Proofpoint put properly reported simulated phishing at 18.3% across its 2024 State of the Phish sample of 7,500 working adults, which gives a rough floor for an untrained population. In the programmes I have run, the pattern I see is different: once reporting crosses roughly half a population on a given simulation, the security team starts hearing about suspicious emails from staff within hours instead of days, and that speed is what reduces dwell time in a live incident. I have also watched reporting rate climb while click rate stayed flat, which is a sign of progress a board asking only about click rate will never see.

How do you brief the board on this?

Brief the board with a trend line across at least four quarters, not a single snapshot, and tie every metric to something the board already funds: how fast the organisation would notice a live attack. I bring four charts instead of one bar to a board meeting: reporting rate over time by business unit, median time-to-report, repeat-clicker concentration against departments with financial or data access, and click-to-report ratio for the population as a whole. Gartner’s own framing has moved this direction. Its 2025 cybersecurity trends release and 2026 update both describe a move toward what it calls security behavior and culture programmes, measuring demonstrated behavior under a live threat rather than training completion. Boards that hear this framing tend to stop asking for a single percentage within one or two cycles.

Where do human risk scores go wrong?

Human risk scores go wrong when they combine click rate and training completion into one composite number and call it something new. Gartner predicts that enterprises combining generative AI with an integrated, platform-based security behavior and culture programme will see 40% fewer employee-driven cybersecurity incidents, a forecast repeated across its 2025 and 2026 trend releases. I hope that prediction comes true, but I have watched vendors ship a risk score built from the two weakest inputs available: whether someone clicked, and whether someone finished a training module. Neither measures whether the organisation would catch an attack in progress. A score built only from failure data tells every employee the programme is watching for mistakes, not effort, and that framing pushes the exact behavior no programme wants, which is staff who say nothing about a suspicious email rather than risk being flagged again. A risk score worth reporting has to include reporting behavior as a positive input, not just clicking as a negative one. If yours doesn’t, it is measuring what click rate always measured, wearing a better name.

You are a security awareness and human risk advisor preparing a board update. I will paste our current phishing simulation results (click rate, report rate, and any other fields we track) for the last four quarters, broken down by business unit if available. Using only the data I provide, do four things: (1) identify which metrics show a genuine multi-quarter trend versus which are noisy single-quarter blips, (2) flag any business unit where reporting rate is falling while click rate stays flat, since that combination is a leading indicator worth board attention, (3) note any metric that has moved the wrong direction for two consecutive quarters, and (4) draft a one-page board narrative that leads with reporting rate and time-to-report rather than click rate, in plain language a non-technical board member would understand. If the data I paste is incomplete or ambiguous, ask me clarifying questions before drafting the narrative rather than guessing at missing numbers.

You are a data analyst helping a security awareness programme interpret its phishing simulation data. I will provide a table of individual simulation results: date sent, department, template difficulty, and whether each recipient clicked, reported, or did neither. Analyze this data to surface which departments have the highest repeat-clicker concentration (people who clicked more than once across the period), the median and mean time-to-report in hours, and whether click-to-report ratio is improving or worsening over the period covered. Present findings as a short table plus two or three sentences of plain-language interpretation, and explicitly say if the sample size for any department is too small to draw a conclusion. Ask me for department headcounts if you need them to judge sample size.

You are a security awareness programme lead designing a tabletop exercise about AI-generated phishing and vishing for a group of non-technical staff, including finance and HR. Build a 45-minute exercise with four parts: a realistic scenario involving an AI-generated email or voice message impersonating an executive requesting an urgent wire transfer or credential reset, a set of five decision points where participants must choose what to do next, a short list of red flags participants should have noticed, and a debrief script that explains what made the deception convincing without teaching participants how to build one themselves. Keep the language non-technical, define any jargon like 'deepfake' in plain terms before using it, and flag any part of the scenario that could be mistaken for real instructions if it leaked outside the exercise. Ask me how many participants and what industry before finalizing details specific to our threat model.