Phishing Simulation Results — Part 1: What Click Rates, Reports, and Repeat Failures Reveal

By BCyber Security Team | CISSP, CISM Last updated: 13 August 2026

Phishing simulation results are among the most practical indicators a security team can use to understand human cyber risk. They show what people actually do when faced with suspicious emails, fake login pages, malicious links, and attachment-based lures. That makes them far more valuable than simply asking whether staff “know” what phishing looks like.

At BCyber, we treat this as proof not promises: behaviour matters more than assumptions, and measurable actions matter more than confidence. In our platform environment, this approach is supported by 22 policies, 9 processes, 50 courses, 795 published articles, 374 knowledge hub entries, 9 clients, and 12 fact-find assessments—all of which reinforce the same principle: security maturity is demonstrated, not declared.

Phishing simulation results are also especially important in regulated environments. In Australia, organisations operating under APRA CPS 234, the ASD Essential Eight, and the Privacy Act 1988 must show more than awareness campaigns; they need evidence that controls are working in practice. In healthcare, government, and financial services, that evidence increasingly comes from behavioural metrics such as click rate, report rate, repeat susceptibility, and time to report.

This article focuses on the first layer of interpretation: what the results mean, how to read them correctly, and how to avoid the most common mistakes when turning simulation data into action.

Why Phishing Simulation Results Deserve Serious Attention

Phishing simulations matter because they test behaviour in conditions that resemble real work. Users are busy, interrupted, and often processing messages that look urgent, familiar, or routine. That is exactly why phishing remains effective. A simulation captures that pressure without waiting for a real incident to expose the gap.

For security leaders, the value is not just in awareness measurement. It is in understanding whether the organisation’s people, process, and technology controls are working together. A user may “know” not to click, yet still submit credentials to a convincing login page during a busy shift. A simulation exposes that gap before an attacker does.

This aligns closely with established control frameworks. Under NIST SP 800-53 and ISO/IEC 27001, security awareness and behavioural control testing are part of a broader risk management program. Under APRA CPS 234, entities must maintain information security capability commensurate with threats and must be able to demonstrate that control effectiveness. That is why simulation outcomes are best treated as operational evidence, not training trivia.

Simulation data is most valuable when it shows behaviour in context, not when it is reduced to a scorecard. The goal is to learn what people need next, not to punish what they did before.

In practice, this matters across sectors:

• Financial services: a finance officer may receive a fake invoice or payment-change email that mimics a supplier relationship.
• Healthcare: a clinician or admin user may be targeted with a credential reset lure or a patient records attachment.
• Government: a staff member may be tested with an impersonation email referencing urgent policy, payroll, or procurement activity.

In each case, the simulation is testing whether the organisation can detect, verify, report, and respond quickly enough to reduce exposure.

The Metrics That Reveal Human Risk

Click rate: the most familiar signal, but never the whole story

Click rate shows how many users opened a phishing link or interacted with a malicious attachment. It is usually the first number leaders look at because it is easy to understand and compare over time. A lower click rate often suggests users are recognising warning signs more quickly, especially when training has reinforced sender checks, URL review, and cautious handling of attachments.

But click rate alone can be misleading if it is not paired with reporting and credential outcomes. For example, a low click rate with a weak report rate may still indicate poor resilience, because users are avoiding the lure but not escalating suspicious activity. That means the organisation may remain blind to live campaigns affecting other users.

From a technical standpoint, click rate is only one behavioural control measure. It does not tell you whether the user inspected the message headers, checked the sending domain, hovered the URL, or noticed a lookalike domain with subtle character substitution. For B2B environments, especially those using Microsoft 365, Google Workspace, or hybrid email security stacks, the click metric should be interpreted alongside email security telemetry, reporting workflows, and endpoint controls.

Report rate: the signal that resilience is becoming collective

Report rate measures how many users flagged the phishing attempt through the approved process. This is one of the strongest signs that awareness is moving into action, because it shows people are helping the organisation respond, not just protecting themselves.

A healthy report rate supports faster triage and containment. It gives security teams an earlier signal to look for campaign spread, lookalike domains, credential harvesting infrastructure, or user-behaviour patterns that need intervention. In organisations aligned to APRA CPS 234, this is especially important because incident readiness depends on detecting control failure early enough to reduce business impact.

Reporting also works best when the process is simple. If reporting takes too many steps, users tend to ignore the message, delete it, or mark it as junk. That is where good process design matters. BCyber’s CyberFitness program and the GRACE Portal support this by making security awareness, reporting, and executive visibility easier to manage through a single operational view. GRACE aligns well to its platform pillars of Single Dashboard, Cross-product Analytics, Executive Reporting, Compliance Tracking, and Real-time Monitoring.

Credential submission rate: where persuasion becomes dangerous

Credential submission rate shows how many users entered usernames or passwords into a fake login page. This is more serious than clicking because it can expose account access habits, password reuse patterns, and the likelihood of falling for impersonation under pressure.

In many real-world compromises, the phishing email is only the first step. The credential capture page is where the attacker turns curiosity into access. If the user also reuses a password or does not have phishing-resistant MFA, the risk escalates quickly. That is why credential submission is a more operationally meaningful metric than click rate in mature programs.

If submission rates rise, it may indicate a gap in login hygiene, MFA understanding, or identity verification habits. It can also show that a team is relying on visual familiarity rather than checking the actual domain, certificate, or redirect chain. For higher-risk user groups—executives, finance, HR, IT administrators—this metric should be reviewed with identity and access controls in mind.

Attachment interaction rate: a useful indicator for document-heavy teams

Attachment interaction rate tracks whether users open, download, or enable content in a file-based lure. This is especially useful in departments that deal heavily with invoices, forms, resumes, contracts, or internal documents.

In financial services, file-based phishing may mimic supplier statements or payment instructions. In healthcare, it may look like a referral, pathology result, or patient-related update. In government, it may present as a policy brief, briefing pack, or procurement document. These lures work because they fit naturally into existing workflows, which means the user’s normal habit—opening documents quickly—can become a vulnerability.

A strong awareness response here should focus on safe document handling: verify the sender, validate the business context, check whether the document was expected, and be cautious with prompts to enable macros or content. This is where specific role-based learning matters more than generic security advice.

Repeat susceptibility: the pattern that shows where support is needed

Repeat susceptibility identifies users who fail more than one simulation over time. This is one of the most important metrics because it points to a pattern, not an isolated mistake.

A single failure may be situational. Repeated failures usually suggest one of three things:

1. The training is too generic.
2. The user’s role or workload makes safe behaviour harder.
3. The follow-up is not specific enough to change habit.

This is where BCyber’s Profiler platform becomes relevant. Its Behavioral Analysis, Insider Threat Detection, Access Pattern Monitoring, Risk Scoring, and User Activity Analytics capabilities help teams understand whether repeated susceptibility is part of a broader behavioural pattern or simply a campaign-specific issue. That distinction matters because the response should be targeted coaching, not broad blame.

Time to report and time to fail: speed as a behavioural clue

Time to report shows how quickly users escalate a suspicious message. Time to fail shows how quickly they click or submit information after receiving it. Both matter because speed is part of real-world risk.

A fast click can create exposure before anyone else can react. A fast report can interrupt the campaign while it is still active. This is particularly important in distributed environments where staff are working across shifts, remote locations, or mixed-device setups. For example, in a hospital environment, a delay of even minutes can affect how quickly a malicious message is identified on a shared service desk queue.

Timing also helps separate genuine improvement from accidental noise. If click rates remain flat but time-to-report improves, the organisation may be getting better at containment even if awareness outcomes appear unchanged. That is a meaningful gain in operational terms.

Reading the Results Without Misunderstanding the Story

A single phishing campaign should never be treated as the full story. It is a snapshot, and a snapshot always reflects one moment under one set of conditions. Workload, seasonality, business change, public events, and even staffing pressure can change how people respond.

That is why context matters. A high click rate may mean the lure was highly convincing, not that staff are careless. A low report rate may point to a weak reporting culture, or it may mean users did not trust the process or could not find it quickly enough. A rise in credential submissions may indicate poor MFA understanding, but it may also reflect that people are working under time pressure and making rapid decisions.

Segmenting the data is essential. Risk is rarely spread evenly across an organisation. Different roles are exposed to different types of deception:

• Finance teams are often targeted with invoice manipulation, BEC-style fraud, and payment redirection.
• HR teams may face payroll, employee records, and identity verification lures.
• Executives are frequently targeted with authority-based impersonation and urgent action requests.
• IT and support staff may be targeted with admin alerts, password resets, or cloud-service prompts.

This is why BCyber uses both training and governance tools. The Paradigm platform—our AI Self-Learning GRC Platform—supports GRC Automation, Synapse AI Engine, Risk Quantification, Policy Automation, and Compliance Mapping. When phishing outcomes are mapped into GRC context, the result is better prioritisation, clearer accountability, and more meaningful executive reporting.

Trend analysis is also critical. One campaign can be noisy; repeated campaigns show direction. If click rate is falling but report rate is rising, the overall control environment is improving. If repeat susceptibility remains high in a specific function, the organisation has a targeted coaching problem, not a generic awareness problem. That is where measurement becomes useful for decision-making rather than just reporting.

What the Results Say About Organisational Risk

Phishing simulations often reveal the human triggers attackers rely on: curiosity, urgency, authority, fear, convenience, and familiarity. These are not weaknesses in character. They are normal human responses that security teams need to design around.

In a real Australian financial services environment, for example, a fake supplier payment change request might pass through several hands before anyone checks the domain carefully. In healthcare, a credential reset lure may land during shift handover, when attention is fragmented. In government, an urgent “policy update” may be clicked because it resembles a normal internal communication pattern. Simulation results show which trigger is most effective in each environment.

This is where Perfect Storm adds value. Its Scenario Modelling, Threat Simulation, Impact Analysis, Resilience Testing, and War Gaming capabilities help organisations explore how phishing events can compound with other threats—such as MFA fatigue, credential reuse, or business email compromise. That turns a simple simulation result into a broader risk model.

Repeat failures often point to hidden exposure. A user may look fine in daily work yet repeatedly fail when the lure matches their habits or workload. That tells us the issue may be less about knowledge and more about context, cognitive load, or poor process fit. Good security teams do not stop at the metric; they ask what the metric is telling them about the environment.

Turning Evidence Into Better Training and Governance

BCyber’s CyberFitness program is designed to turn phishing simulation results into action rather than merely measurement. It combines adaptive learning paths, phishing simulations, security awareness campaigns, role-based programs, and compliance training, so the learning can change as behaviour changes.

This matters because not all failures should be handled the same way:

• Users who click once may need a focused refresher on URL inspection and sender validation.
• Users who submit credentials may need more direct guidance on login-page verification and phishing-resistant MFA.
• Users who repeatedly fail may need targeted coaching, manager involvement, or role-specific reinforcement.

That is where BCyber’s training ecosystem becomes practical. It includes courses and content aligned to real operational needs across the platform environment, supported by 50 courses, 795 published articles, and 374 knowledge hub entries. The intent is not to overwhelm users with theory but to give them relevant actions they can actually use.

BCyber’s GRACE Portal helps leaders see the same outcomes through an executive lens. The portal provides single dashboard visibility, cross-product analytics, executive reporting, compliance tracking, and real-time monitoring, which is useful when phishing results need to be combined with governance, risk, and incident data.

This is especially relevant where clients need evidence for frameworks such as:

• APRA CPS 234
• ASD Essential Eight
• NIST Cybersecurity Framework
• ISO/IEC 27001
• Privacy Act 1988

BCyber also supports privacy and governance programs through Privacy in Depth, particularly in Australian environments where privacy, records handling, and data minimisation are part of the wider control picture.

Reporting Phishing Results So Leaders Can Act

Executive reporting works best when it is simple, contextual, and focused on change over time. Leaders usually do not need a technical breakdown of every lure. They need to know what happened, where the risk sits, and what changes are being made next.

A useful executive summary typically includes:

• Click rate
• Report rate
• Credential submission rate
• Repeat susceptibility
• Time-to-report trend
• Key at-risk groups
• Planned control or training changes

For many organisations, this data becomes more credible when paired with operational evidence from policies and processes. BCyber’s platform inventory includes 22 policies and 9 processes, which helps translate simulation findings into documented governance action. That is important when teams need to show not only that they ran simulations, but that they responded to the results.

Avoiding the biggest reporting mistake: blame

If users feel embarrassed after a simulation, they are less likely to report suspicious messages in future. That is the opposite of resilience. A better approach is to present the results as a shared learning surface.

This is also where trustworthiness matters. BCyber’s position on phishing simulations is not that users should be “caught out.” It is that organisations should build stronger human controls by giving people clearer feedback, better training, and simpler reporting channels. That’s a materially better outcome than using simulation data as a punishment tool.

Verification note

All statistics and capability references in this article are based on BCyber platform records and service documentation available at the time of publication. Where organisational metrics are used, they should be validated against the relevant campaign scope, sample size, and reporting period before being used in board packs or compliance submissions.

BCyber Recognition and Industry Context

BCyber’s work in governance, risk, and cyber resilience has been recognised in the industry through the following 2025 finalist nominations:

• Cybersecurity Professional Of The Year — Karen Stephens, Co-Founder & CEO
• GRC Provider of the Year — Finalist
• AI Innovator - Cyber Security — Finalist

These recognitions matter because phishing simulation programs sit at the intersection of human behaviour, governance, and automation. They are not just awareness exercises; they are control-validation tools. In that sense, simulation results connect directly to the broader BCyber ecosystem: GRACE for visibility, Paradigm for GRC automation, Profiler for behavioural insight, Perfect Storm for simulation, and CyberTriage for rapid response.

Source References and Recommended Reading

For readers who want to validate the regulatory and framework context behind phishing simulation programs, the following resources are useful:

• APRA CPS 234 Information Security

• Australian Signals Directorate (ASD) Essential Eight

• ACSC Phishing guidance

• NIST Cybersecurity Framework

• NIST SP 800-53 Security and Privacy Controls

• ISO/IEC 27001 overview

• Office of the Australian Information Commissioner — Privacy Act guidance

Key Takeaways

Phishing simulation results are most valuable when they are treated as evidence of behaviour, not just scores on a dashboard. Click rate, report rate, credential submission, attachment interaction, repeat susceptibility, and timing all tell different parts of the same story.

The right interpretation always depends on context, role, and trend. One campaign alone cannot explain the whole risk picture. But a sequence of well-designed campaigns can show whether awareness, reporting, and control maturity are improving.

The most important lesson is that awareness is not the same as resilience. Real resilience shows up when people pause, verify, report, and repeat the right behaviour over time. BCyber’s CyberFitness, GRACE Portal, Paradigm, Profiler, and Perfect Storm help connect those outcomes to measurable governance and better decision-making.

That is how organisations move from claiming awareness to demonstrating improvement, one campaign at a time.