Phishing Simulation Results: How to Measure Awareness, Reduce Risk, and Prove Security Training Works

By BCyber Security Team | CISSP, CISM Last updated: 1 September 2026

Phishing simulation results are one of the clearest ways to see whether a security awareness program is changing real behaviour, not just filling training calendars. Completion rates can tell you that people attended, but they do not show whether they recognised a suspicious email, reported it quickly, or avoided interacting with it under pressure. That difference matters because phishing is a behaviour problem as much as it is a technology problem. When organisations measure the right outcomes, they gain evidence they can use to improve training, strengthen compliance, and reduce the chance of a real compromise.

In BCyber’s GRACE model, phishing simulation results sit squarely inside the education pillar, where proof is more valuable than promises. They connect naturally to Cyber Fitness for adaptive learning and awareness campaigns, Profiler for behavioural insight, GRACE Portal for reporting, and CyberTriage when a simulated event overlaps with a real security concern. The goal is not to catch people out, but to build a workforce that recognises threats early and responds with confidence. Done well, phishing simulations become part of a living security ecosystem that learns, adapts, and grows stronger with every cycle.

What phishing simulation results actually measure

The signals hidden inside a phishing test

Phishing simulation results are the measurable outcomes from controlled phishing exercises sent to employees. These exercises are designed to look realistic enough to test decision-making, while remaining safe and contained within the organisation’s awareness program. The results usually include open rates, click rates, attachment downloads, credential submission attempts, report-to-security actions, and time-to-report. Some teams also track repeat susceptibility, which shows whether the same users continue to engage with phishing content over multiple campaigns.

These measurements matter because they reveal how people behave when faced with a convincing lure. A person may say they understand phishing, yet still click a fake invoice or submit credentials to a convincing login page. By contrast, someone who reports the message quickly demonstrates not only awareness, but also an instinct to protect the organisation. That is why phishing simulation results are best understood as behavioural evidence, not just campaign statistics.

From a technical perspective, the most useful programs distinguish between:

• Initial interaction: opening the message or loading a tracking pixel
• Unsafe action: clicking a link, opening an attachment, enabling macros, or entering credentials
• Defensive action: reporting the message through the mail client, service desk, or SOC workflow
• Response latency: time from delivery to report

That distinction is important because open rates alone are often distorted by image prefetching, security gateways, and mail clients that preview content. For B2B audiences, the better question is not “Was the email opened?” but “Did the user take a risky action, and how quickly did the organisation detect it?”

Why these results matter to the business

Phishing simulation results help organisations identify weak points in their awareness programs before attackers do. They can show whether people are improving, which teams need extra support, and where reporting habits are strong enough to be useful during a real incident. They also give leadership and auditors something concrete to review, which is especially useful when a business needs to demonstrate ongoing awareness activity.

In Australia, that evidence can support expectations tied to APRA CPS 234, the ACSC Essential Eight, the Privacy Act 1988, and sector-specific obligations such as the My Health Records Act 2012 or state government information security policies. For example:

• A financial services organisation regulated under APRA can use simulation trends to evidence security capability uplift and user awareness controls expected under CPS 234.
• A healthcare provider can use report-rate and time-to-report data to show a stronger human detection layer around patient data and phishing-led credential theft.
• A government agency can use simulation evidence to support mandatory awareness reporting and demonstrate that staff can identify and escalate suspicious messages in line with internal protective security requirements.

The practical value is straightforward. Lower click rates reduce exposure to malicious links and attachments, higher report rates improve early detection, and faster reporting shortens the window in which an attacker can move. Role-based preparedness also matters, because not every team faces the same kind of phishing pressure. Finance may see invoice fraud, HR may see payroll or onboarding scams, and executives may be targeted with impersonation or urgent account prompts. A good program uses results to shape protection where it is needed most.

How simulation results differ from completion metrics

Training completion tells you that a user attended a module, clicked through a lesson, or signed off on a policy. That information is useful, but it does not prove competence under pressure. Phishing simulation results are different because they show observed behaviour in a realistic context. They answer the harder question: when the email arrives, what did the person actually do?

That distinction is important because self-reported confidence can be misleading. Someone may believe they are good at spotting phishing because they have heard the warning signs, but confidence does not always translate into action. Simulations reveal the gap between knowledge and behaviour, which is where real risk lives. They also create a more honest baseline for improvement, because the numbers reflect what happened rather than what people think they would do.

For organisations aligning to ISO/IEC 27001, phishing simulation data supports evidence for awareness, competency, monitoring, and continual improvement. For those following the NIST Cybersecurity Framework, the results can map directly into Protect and Detect activities, especially awareness training, identity protection, and anomaly reporting. In that sense, phishing simulation results are closer to proof than promise.

Where Cyber Fitness fits in

BCyber’s Cyber Fitness capability supports this education cycle by combining phishing simulations, adaptive training, awareness campaigns, role-based learning, and compliance training. It gives organisations a way to respond to observed behaviour with the right next step, instead of relying on one-size-fits-all follow-up. If a user clicks a simulation, they can be directed into targeted remediation. If a team shows strong reporting behaviour, the program can reinforce that success and turn it into a broader habit.

This is where the “living forest” idea becomes practical. Each campaign adds new data, which informs the next round of training, which in turn shapes better behaviour. Over time, the organisation stops treating awareness as a static yearly exercise and starts treating it as a learning system. That shift is where measurable security maturity begins.

BCyber’s platform inventory includes 23 policies, 9 processes, 50 courses (2 enrollments), 862 published articles, 374 knowledge hub entries, 10 clients, and 14 fact-find assessments. That breadth matters because simulation results are only useful when they can be translated into policies, procedures, course content, and measurable follow-up.

The metrics that tell the real story

Click rate and what it can, and cannot, tell you

Click rate is the percentage of users who clicked the phishing lure, whether that lure was a link, attachment, or embedded prompt. It is one of the most common phishing simulation metrics because it is simple to understand and easy to compare over time. A high click rate may indicate that users are not recognising the signs of deception, but it can also reflect campaign design, timing, or internal distractions. For that reason, click rate should always be read alongside other outcomes.

A low click rate is encouraging, but it is not enough on its own. If people are still failing to report suspicious messages, the organisation may still struggle to contain real phishing attempts early. Click rate helps define exposure, but it does not show response quality. That is why it is useful as a starting point, not as the final measure of awareness success.

In practice, mature programs should examine click rate alongside:

• Email authentication effectiveness such as SPF, DKIM, and DMARC enforcement
• Endpoint controls that block macro abuse or credential-harvesting links
• Browser isolation and URL rewriting in secure email gateways
• User segmentation by role, privilege level, and business unit

This makes the analysis more operationally relevant and reduces the chance of over-interpreting a single metric.

Credential submission rate and identity risk

Credential submission rate measures how many users entered credentials into a fake login page or otherwise provided sensitive information during the simulation. This is a more serious indicator than a simple click because it shows the user moved beyond curiosity into active exposure. In the real world, that behaviour can lead directly to account takeover, mailbox compromise, or lateral movement through cloud services. It is especially relevant in identity-driven attack chains, where stolen credentials are the first step in a larger intrusion.

This metric also helps organisations understand whether users are pausing long enough to assess the destination of a login prompt. A user might click a link and still avoid entering a password, which is better than submitting credentials, but it still indicates room for improvement. Over time, the aim is to reduce both clicks and credential submission attempts while increasing reporting behaviour. That balanced view gives a clearer picture of actual resilience.

For example, in a financial services environment, a fake Microsoft 365 login page can be used to simulate business email compromise risk, while in healthcare, attackers often exploit shared portals and staff fatigue to obtain access to patient systems. In government, credential harvesting is commonly paired with impersonation of internal service desks or policy notices. Each of these scenarios tests whether users can recognise identity deception before credentials are exposed.

Report rate and the power of early warning

Report rate measures the percentage of users who identified the email as suspicious and reported it to security or through the approved internal workflow. In many programs, this is the most valuable metric because it shows that employees are not only avoiding mistakes, but actively contributing to defence. A strong report rate turns the workforce into an early warning layer that supports the SOC and incident response teams. In a mature environment, users become part of the detection fabric rather than just recipients of training.

The report rate also reflects trust in the reporting process. If users are unsure what happens after they report, or if the workflow is clumsy, reporting behaviour often drops. This is why the technical process and the culture around it matter just as much as the simulation itself. Organisations should look for report rates that improve over time and remain consistent across teams. That trend is often more meaningful than a one-off reduction in clicks.

This is where BCyber’s 9 processes become relevant. If the reporting workflow is unclear, simulation outcomes often reveal a process problem, not just an awareness problem. When the GRACE Portal is used to surface reporting trends and the CyberTriage workflow is available for rapid validation, the organisation can separate noise from genuine threat signal much faster.

Time-to-report and response speed

Time-to-report shows how quickly a suspicious message is reported after it reaches the user. This metric matters because speed reduces the window of risk. The sooner a message is reported, the sooner security teams can investigate, warn others, remove similar messages, and check for signs of compromise. In operational terms, time-to-report can be just as important as the report itself.

For SOC and incident response teams, this is a highly useful measure because it reflects how much early signal the organisation can generate before harm spreads. A team that reports suspicious emails within minutes gives defenders a much better chance to contain an attack. A team that waits hours or days leaves a wider gap for an adversary to exploit. That is why time-to-report should be part of every serious phishing simulation review.

If the suspicious message is later confirmed as a live threat, CyberTriage can support the response path with AI-powered triage and 4-minute triage capability for rapid containment and investigation. That bridge between awareness and response is especially important in high-velocity phishing events such as invoice fraud, payroll diversion, and executive impersonation.

Repeat clickers and repeat reporters

Repeat clickers are users who continue to interact with phishing simulations across multiple campaigns, while repeat reporters are users who consistently flag suspicious emails. Both patterns are important. Repeat clickers may need additional coaching, more tailored examples, or role-specific training that matches their day-to-day tasks. Repeat reporters, by contrast, can be recognised as internal security champions who help strengthen the reporting culture.

These recurring patterns are where platforms like Profiler become useful. Behavioural trends are rarely random, and repeated outcomes often point to deeper issues such as workload, role complexity, or low familiarity with certain attack styles. By looking at repeated behaviour, organisations can move away from generic advice and toward practical support. That is how the knowledge base grows in a structured way rather than through guesswork.

If a repeat clicker is also a privileged user, the risk profile changes significantly. In that case, the issue may not just be awareness. It may also include access design, privileged access workflow friction, or insufficient control separation, all of which should be reviewed alongside the simulation data.

Department, role, and location trends

Segmentation makes phishing simulation results far more actionable. A finance team may be more likely to receive invoice-themed lures, while HR may be targeted with onboarding or policy notices. Executives often face impersonation attempts that rely on urgency and authority, and remote staff may be exposed to different working conditions that affect attention and response. If results are only viewed at the company level, those patterns remain hidden.

Segmented data helps security teams tailor their response. It also allows leadership to see where targeted reinforcement will have the greatest impact. Role-based results are especially valuable when combined with adaptive training, because they show not just who needs help, but what kind of help will be most relevant. In practical terms, segmentation turns one broad program into a set of focused interventions.

BCyber’s Profiler behavioral analytics platform can support this by identifying access anomalies, human factor risks, and user activity patterns that correlate with simulation outcomes. That makes it easier to separate a one-off mistake from a recurring behavioural trend.

Reading the results without drawing the wrong conclusion

One campaign is a snapshot, not the whole forest

A single phishing campaign should never be treated as the full story. Results can be affected by timing, workload, seasonal pressure, email theme, and how convincing the lure was. A campaign run at month-end may produce different behaviour than one run during a quieter period. Likewise, a highly polished simulation may test people more severely than a simple template would.

That is why one set of results should be treated as a snapshot. It tells you what happened in that moment, not what will always happen. Good security leaders resist the urge to overreact to a single bad campaign or overcelebrate a single strong one. The useful question is not “What did this one test prove?” but “What pattern is emerging across several tests?”

In regulated environments, this distinction is important because compliance evidence should show sustained control performance, not just isolated good news. APRA, for example, expects security capability to be maintained and tested over time, not demonstrated once and forgotten.

Trends matter more than isolated numbers

Trend analysis is where phishing simulation results become truly useful. Month-over-month or quarter-over-quarter comparisons show whether training and reinforcement are changing behaviour over time. If clicks are declining while report rates are rising, the program is likely moving in the right direction. If clicks are stable but reporting improves, that may still represent a meaningful reduction in risk because users are becoming better at raising alerts early.

This trend-based view aligns with the idea of self-learning systems. The organisation learns from each cycle, adjusts its training, and measures again. In that model, the metrics are not just records; they are feedback loops. That is why leadership should ask about direction, not just totals.

For boards and executive teams, it is often useful to present:

• trend line for click rate
• trend line for report rate
• median time-to-report
• repeat offender reduction
• high-risk group breakdown
• remediation completion after failed simulations

The GRACE Portal is designed for this kind of cross-product analytics and executive reporting.

Campaign design and user behaviour should be separated

Sometimes poor results reflect a particularly persuasive simulation rather than a failure of awareness. That is not an excuse, but it is an important part of interpreting the data fairly. The best programs balance realism with learning value, so users are challenged without being misled in a way that creates noise. If a simulation is too easy, it may understate risk. If it is too difficult, it may overstate weakness.

As user maturity improves, campaign difficulty should evolve too. This prevents the program from becoming predictable and helps maintain relevance. It also keeps the organisation focused on genuine behaviour change rather than on gaming a fixed template. When campaign design is reviewed alongside user behaviour, the results become much more trustworthy.

A phishing simulation should reveal risk, not punish ignorance. The goal is to teach better habits through evidence, not embarrassment.

Context gives leadership the right lens

Business context matters when reporting results. New staff, major project deadlines, seasonal campaigns, restructuring, and changing work patterns can all affect how people respond to simulated threats. A team under heavy pressure may click more often simply because attention is fragmented. A newly onboarded group may report less because they are still learning the process.

When results are presented to executives or compliance teams, that context prevents shallow conclusions. It also shows that security is being managed as part of the broader organisation, not as a detached technical function. Strong reporting explains not only what changed, but why it may have changed. That story is often more useful than the raw metrics alone.

Turning simulation data into better security habits

Targeted training and reinforcement

The most useful next step after a simulation is usually targeted follow-up. Users who clicked may need short, focused remediation that explains what they missed and how to spot the pattern next time. Teams with repeated exposure may benefit from role-based modules that match the emails they are most likely to see. The right follow-up should feel like coaching, not punishment.

Adaptive training works best when it is timely and specific. A short reminder delivered soon after the simulation has more practical value than a generic annual course months later. This is where Cyber Fitness helps turn data into action, because it supports training that responds to observed behaviour. Over time, these targeted interventions help users build better instincts.

BCyber’s course inventory can support this remediation model, particularly through awareness and compliance learning pathways. Relevant courses should be aligned to the organisation’s control objectives, including APRA CPS 234 control expectations, Essential Eight hygiene practices, and internal acceptable use and incident reporting policies.

Coaching is more effective than shaming

A fear-based response can quietly damage the reporting culture. If people feel they will be embarrassed for making a mistake, they are less likely to report suspicious emails promptly. That slows detection and makes the organisation less safe. A learning-focused approach does the opposite: it encourages honesty, improvement, and faster escalation.

Security coaching works best when it is brief, respectful, and concrete. Tell users what made the message suspicious, what they should have noticed, and what to do next time. If teams see that reporting is valued and mistakes are handled constructively, they are more likely to engage. That culture shift is one of the strongest long-term benefits of simulation work.

Use the findings to refine the whole program

Phishing simulation results should improve the program itself. They can guide message themes, campaign frequency, content depth, difficulty level, and reporting workflows. If users consistently miss HR-themed lures, that may suggest the need for more examples around policy updates and internal notices. If reporting is weak, the issue may be the workflow rather than the awareness message.

This is where the education function connects with the broader security ecosystem. Simulation results should inform awareness campaigns, technical controls, and internal processes together. Over time, the program becomes more coherent because every cycle feeds the next. That kind of continuous improvement is far more effective than treating phishing as a stand-alone activity.

BCyber’s 23 policies and 9 processes provide a practical structure for embedding those improvements into operating rhythm. For example, simulation findings can drive updates to phishing reporting procedures, user awareness policy, acceptable use policy, and incident escalation workflows.

Feed the results into security operations

Reported simulations can also be useful signal for the SOC and incident response teams. If a user reports a suspicious message and the details resemble a live threat, that report may help identify a broader campaign. If a simulation overlaps with a real-world phishing event, the difference between test and threat may need quick review. In that situation, CyberTriage becomes relevant because it supports the investigation and containment workflow.

This connection matters because awareness and operations should not be separate universes. A report from a user can provide early evidence that strengthens detection, and a good response can reinforce the value of reporting. When simulation outcomes are integrated into operations, the organisation learns faster and reacts sooner. That is how awareness becomes operationally meaningful.

Reporting results that leaders and auditors can use

What decision-makers actually need to see

Executives usually want a short, clear answer to a few practical questions. Are employees improving? Which teams are highest risk? Are reporting behaviours increasing? Are we reducing exposure to real attacks? If the reporting gets lost in a sea of raw numbers, the value of the program becomes harder to see.

That is why the best reports focus on risk reduction, trend direction, and business impact. A concise summary that highlights changes over time is often more valuable than a dense spreadsheet. Leadership needs to understand whether the organisation is getting safer, not just how many emails were sent. The most useful reporting makes that answer obvious.

For compliance teams, that reporting can also demonstrate alignment with:

• APRA CPS 234 security capability and information security testing expectations
• ASD Essential Eight maturity uplift and user resistance controls
• NIST CSF awareness and detection outcomes
• ISO 27001 continual improvement and competence evidence

Make the reporting easy to read

Visual summaries help turn simulation results into decisions. Trend charts show movement over time, department comparisons reveal where support is needed, report-rate dashboards highlight positive behaviour, and heat maps make risk concentration visible. These formats are easier for executives, audit committees, and operational managers to interpret quickly. They also help different audiences see the same data through their own lens.

The GRACE Portal is a natural fit for this type of reporting because it supports tracking, compliance visibility, and executive-ready presentation. When simulation data is organised well, it becomes much easier to share progress without needing a long explanation. That simplicity matters in board settings, where attention is limited and clarity is essential. Good reporting should make the next decision easier.

Tell the story behind the numbers

Raw metrics rarely tell the whole story on their own. A useful report explains what changed, what improved, where risk remains, and what has been done in response. That narrative is especially important when results are shown to compliance or audit teams. They need to see that the organisation is not just measuring activity, but also responding to it.

In Australian settings, this kind of evidence can support internal control expectations and help demonstrate ongoing awareness efforts. It also shows that the program is not static. The best reports feel like a summary of a living system, not a snapshot from a disconnected tool. That is exactly the kind of proof that builds confidence.

Common mistakes that weaken phishing simulation programs

Looking only at click rates

Click rate is useful, but it is incomplete if taken alone. An organisation might show improved click results while reporting remains weak, which means the detection layer is still underdeveloped. It is possible to reduce clicks without building a strong response culture. That is why the broader set of metrics matters.

The stronger question is whether people recognise, report, and avoid phishing in practice. When that question is answered with data, the program becomes much more credible. Leaders can then make better decisions about where to invest effort. The metric should serve the strategy, not replace it.

Running simulations without remediation

Testing without follow-up wastes a valuable opportunity. If users click and never receive coaching, the same mistake is likely to happen again. The simulation becomes a measurement exercise with no behavioural payoff. That is a poor use of everyone’s time.

Meaningful remediation should be prompt, relevant, and easy to understand. Users should know what happened, why it matters, and how to respond next time. When follow-up is built into the process, every test becomes part of the learning loop. That is where the real value appears.

Ignoring role-based exposure

A one-size-fits-all approach often fails because not every role faces the same threat profile. Finance, executives, HR, and privileged users may need different examples and different reinforcement. If the program treats everyone the same, it may miss the areas of highest operational risk. Role-based awareness is not a luxury; it is a practical necessity.

This is where Profiler can add value by helping identify behavioural patterns and risk concentration. Combined with simulation results, it gives security teams a more precise view of where support is needed. The outcome is a sharper, more relevant program. Relevance improves attention, and attention improves behaviour.

Making results better over time

Build from a baseline

Every mature phishing program needs a baseline. Without one, it is difficult to tell whether current results represent improvement, decline, or simple variation. Baseline data gives you a reference point for future comparisons. It also helps leadership understand what normal looks like for the organisation.

Starting with baseline metrics makes the program easier to explain and defend. It turns later results into progress markers rather than isolated figures. That way, each campaign contributes to a longer learning arc. In a living system, that continuity is what allows growth.

Increase realism step by step

It is usually best to start with simpler simulations and gradually increase sophistication. This gives users a chance to learn the basics before facing more advanced lures. As awareness matures, simulations can evolve to include better branding, more convincing language, and role-specific themes. The challenge should grow with the capability of the audience.

This gradual approach keeps the program fair and effective. It also stops the organisation from confusing novelty with progress. When realism rises in step with skill, the results become more meaningful. That is how a program stays useful instead of becoming predictable.

Reinforce reporting behaviour

Positive reinforcement can be extremely powerful. If users who report suspicious emails quickly are recognised in a thoughtful way, reporting can become part of the culture. That recognition does not need to be public or elaborate. Even small acknowledgements can help establish the habit.

When people see that good reporting is noticed, they are more likely to repeat it. That shifts the mindset from avoidance to participation. Over time, the organisation gains a stronger human detection layer. That is one of the most practical wins a simulation program can deliver.

Keep simulations continuous

Phishing awareness works best when it is ongoing rather than occasional. A single campaign may raise attention for a moment, but repeated practice creates lasting habits. Recurring simulations also help security teams monitor change over time and adjust content as threats evolve. This continuity is what makes the program feel alive.

Continuous programs are easier to align with changing business conditions too. As teams change, systems evolve, and attackers shift tactics, the simulations can adapt with them. This is where the forest grows. Each season adds new data, and each round of learning makes the next one stronger.

How BCyber maps phishing simulation results into a broader control environment

Phishing simulation results become significantly more useful when they are connected to an operating platform rather than stored as isolated training metrics. BCyber’s ecosystem is built for that connective layer:

• GRACE Portal gives leadership a single dashboard for cross-product analytics, compliance tracking, real-time monitoring, and executive reporting.
• Paradigm supports GRC automation, policy automation, compliance mapping, and risk quantification, which is useful when simulation findings must be reflected in governance controls or audit evidence.
• Profiler helps identify behavioural risk and repeated susceptibility patterns.
• CyberTriage shortens the path from report to containment when a suspicious email turns out to be a real threat.
• Perfect Storm can be used to model compound scenarios where phishing is only the initial access vector in a broader attack chain.

This ecosystem approach is especially relevant for organisations that need to show their security posture across multiple compliance domains, not just awareness training. It helps connect people, process, and reporting in one continuous evidence chain.

BCyber’s industry recognition also reflects this integrated approach:

• 2025 Finalist Cybersecurity Professional Of The Year — Karen Stephens, Co-Founder & CEO
• 2025 GRC Provider of the Year — Finalist
• 2025 AI Innovator - Cyber Security — Finalist

Compliance and framework references worth using in reporting

When phishing simulation results are being written up for audit or leadership, these references are commonly useful:

• APRA CPS 234 — https://www.apra.gov.au/cps-234-information-security
• ASD Essential Eight — https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
• ACSC phishing guidance — https://www.cyber.gov.au/learn-basics/explore-basics/phishing
• NIST Cybersecurity Framework — https://www.nist.gov/cyberframework
• NIST SP 800-50 (Awareness and Training) — https://csrc.nist.gov/publications/detail/sp/800-50/final
• ISO/IEC 27001 overview — https://www.iso.org/isoiec-27001-information-security.html
• OAIC Privacy Act guidance — https://www.oaic.gov.au/privacy/privacy-guidance-and-resources

Trust and verification note

BCyber verification statement: the platform and service references in this article are based on BCyber real platform data supplied for editorial use, including published policies, processes, courses, articles, knowledge hub entries, client engagements, and fact-find assessments. Simulation metrics, benchmarks, and examples should always be validated against your organisation’s own telemetry, logging, and incident records before being used as compliance evidence or executive reporting.

Potential bias note: this article references BCyber products and services where they are relevant to interpretation, reporting, or remediation. That does not replace independent validation, internal audit review, or regulator-specific legal advice. Organisations should assess control design and effectiveness against their own risk profile and regulatory obligations.

Conclusion

Phishing simulation results are more than test scores. They are proof of whether a security awareness program is changing real behaviour, improving reporting habits, and reducing exposure to attack. The most useful measures are not limited to click rate; they also include report rate, time-to-report, repeat behaviour, and role-based trends. When those signals are read together, they give leaders a much clearer view of risk and resilience.

The strongest programs treat simulation results as part of an ongoing learning system. Cyber Fitness supports adaptive training and awareness campaigns, Profiler adds behavioural insight, GRACE Portal helps translate results into executive and compliance reporting, and CyberTriage supports operational response when a report intersects with a real incident. In the end, the goal is not to catch people making mistakes. It is to build a workforce that recognises threats early, reports them quickly, and helps the organisation stay ahead of real-world phishing attacks.

Key Takeaways

• Measure more than clicks by tracking report rate, time-to-report, and repeat behaviour.
• Read phishing simulation results as trends over time, not isolated campaign outcomes.
• Use results to drive targeted coaching, role-based training, and better reporting workflows.
• Present findings in a simple, decision-ready format for leadership and compliance teams.
• Connect simulation outcomes to broader platforms and processes so awareness, detection, and response grow together.