Smart people click because attacks are designed for competent people in a hurry, not for careless ones. In fifteen years of running security awareness programmes I have never once found that the person who clicked did not know what phishing was. They knew. They clicked anyway, and usually for a reason that made sense at the time.
That gap between what people know and what people do is the entire problem, and almost every awareness programme is built to solve the wrong half of it.
The people who click are usually your good employees
Look at who actually falls for a well-built simulation. It is rarely the person coasting. It is the one who replies fastest, who does not want to hold up a colleague, who saw a message from a senior name and did the responsive thing. Attackers do not target stupidity. They target conscientiousness, urgency and hierarchy, because those are reliable across every organisation on earth.
This is why the annual training video changes nothing. It adds knowledge to people who already had it. It does not touch the conditions under which the mistake gets made.
What actually changes behaviour
Three things, in my experience, in this order of impact.
Coaching at the moment of the mistake. A person who clicks and gets a short, calm explanation within seconds remembers it. The same person told about it in a quarterly module does not. The window where a mistake becomes learning is measured in seconds, not weeks.
Making reporting the easy path. Most people who are suspicious of a message do nothing, because doing something is effort and being wrong is embarrassing. Put a report button where they already are, thank everyone who uses it including the ones who were wrong, and reporting climbs. Reporting matters more than click rate, because reports are how you find the attack that got through to everyone else.
Removing the shame. Programmes that publish click rates by team produce quieter employees, not safer ones. If clicking is humiliating, people hide it, and the hour you lose to hiding is the hour the attacker needs.
What AI changed, and what it did not
The obvious change is quality. The tells we taught people to look for, broken grammar, odd phrasing, generic greetings, are gone. A model writes better English than most native speakers and it can write it in the register of your industry. Advice built on spotting mistakes has expired.
The less obvious change is personalisation at scale. It used to be that a targeted attack on a specific executive took real effort, so only high value targets got one. That cost has collapsed. Everyone can now receive the kind of message that used to be reserved for the finance director.
What has not changed at all is the psychology. Urgency, authority, fear of looking unhelpful. Those levers are the same ones that worked in 2010, because they are human, not technical. Which means the defence that works is still behavioural, and it is now the only defence that scales, because the surface-level tells are gone.
If you are responsible for this at your company
Stop measuring your programme by click rate alone. Measure reporting rate, and measure how fast a report reaches someone who can act. Run simulations that look like the messages your people actually receive rather than the templates that come with the tool. Coach in the moment, never in a quarterly. And treat the people who click as the signal that your process has a gap, not as the gap.
The uncomfortable truth is that a sufficiently good attack will get a click from almost anyone, including you and including me. The programmes that work are the ones designed for that being true.