Phishing Simulation Results – Part 1: What the Data Says About Human Risk, Reporting, and Security Awareness

By BCyber Security Team | CISSP, CISM Last updated: 25 May 2026

Verification note: The BCyber platform figures referenced in this article are verified against BCyber’s internal platform inventory as of 25 May 2026. The analysis is based on aggregated, anonymised phishing simulation outcomes and should be interpreted in context of audience mix, campaign design, and sector risk.

Disclosure: This article is vendor-authored by BCyber Security Team. Readers should validate controls and compliance obligations against their own regulatory environment.

BCyber’s evidence base for this series spans 21 policies, 8 processes, 46 courses (2 enrollments), 529 published articles, 365 knowledge hub entries, 9 clients, and 8 fact-find assessments. That matters because phishing simulation results are most credible when they sit inside a mature body of operational experience—not when they are reduced to a single vanity score on a dashboard.

In this first part of the series, the data points to a consistent theme: phishing education works best when it is measured against real behaviour, not just completion rates. The most useful signals are not only who clicked, but who paused, who reported, who escalated quickly, and who improved after coaching. That aligns closely with BCyber’s proof not promises philosophy, and with the way mature security programs operate under frameworks such as NIST CSF 2.0, NIST SP 800-50, ISO/IEC 27001/27002, the ACSC Essential Eight, and APRA CPS 234.

Why phishing results matter beyond click rates

Phishing simulation results should be treated as behavioural telemetry, not scorekeeping.

A click rate tells you something, but it does not tell you whether the employee:

• reported the message moments later,
• checked the sender domain,
• asked for a second opinion,
• or changed their behaviour after coaching.

That distinction matters in real environments. Under APRA CPS 234, regulated entities must maintain information security capability commensurate with the threats and vulnerabilities they face, and they must notify APRA of material information security incidents within required timeframes. The ACSC Essential Eight adds a practical control baseline that includes patching, MFA, and application control—but none of those controls eliminate the human layer of risk. The same is true for the Privacy Act 1988 and the Notifiable Data Breaches scheme: if a phishing event becomes a privacy incident, the business impact can expand quickly.

The business case is not theoretical. In financial services, a supplier-invoice lure can become business email compromise (BEC) and unauthorised payment diversion. In healthcare, a credential-harvesting email can expose patient systems or care records. In government, a fake document-sharing or service-desk reset email can lead to credential theft and lateral movement. In all three sectors, simulation data helps identify where a mistake could have become an incident before a threat actor arrives.

What the simulation measured and why those signals matter

A useful phishing simulation measures the full behaviour chain, not only the click.

Typical metrics include:

• Open rate
• Click rate
• Submission rate for credentials or sensitive data
• Report rate
• Time-to-report

The most actionable insight comes from the relationship between those metrics. For example, a user who opens, hesitates, and reports the message may be lower risk than a user who never opens the lure but repeatedly ignores security guidance. The quality of the response matters as much as the initial reaction.

From a B2B security perspective, these metrics are most useful when segmented by:

• business unit,
• role,
• geography,
• campaign theme,
• and risk exposure.

That segmentation reveals patterns that a top-line score hides. A finance team may be overexposed to invoice fraud and executive impersonation. A people-and-culture team may be more vulnerable to recruitment, payroll, or onboarding lures. A frontline healthcare team may be under constant time pressure and therefore more likely to act quickly. A government service desk may see repeated password-reset and document-sharing themes.

This is where BCyber’s GRACE Portal becomes valuable. Its single dashboard, cross-product analytics, executive reporting, compliance tracking, and real-time monitoring capabilities help translate simulation data into business language. A phishing result stops being a training statistic and becomes an executive risk signal.

Regulatory lens: what Australian organisations are expected to prove

Australian organisations are increasingly expected to demonstrate that awareness is not just “delivered,” but effective.

Here are three practical examples:

1. APRA CPS 234

1. ACSC Essential Eight

1. Privacy Act 1988 / NDB scheme

For government environments, the Australian Government Information Security Manual (ISM) and related ACSC guidance reinforce the same principle: controls work best when users know how to recognise, verify, and report suspicious activity.

Where employees struggled, and where they showed resilience

The strongest phishing lures tend to exploit urgency, authority, and routine.

Common examples include:

• invoice and payment requests,
• password-reset prompts,
• HR or payroll notices,
• fake delivery or document-sharing alerts,
• and executive impersonation.

These lures work because they mirror ordinary business pressure. A staff member may be busy, moving quickly, or already expecting a similar message. That does not mean the user is careless; it means the attacker has timed the lure to fit the workflow.

In practice, many failures happen at the point where attention narrows and the user acts before verifying. Typical breakdowns include:

• clicking embedded links without checking the domain,
• missing brand inconsistencies or sender spoofing,
• replying to a request that should have been verified out-of-band,
• or failing to recognise that a request uses emotional pressure to override judgement.

The resilience signals are just as important:

• users who report suspicious emails immediately,
• users who pause to verify the request via a second channel,
• teams that escalate quickly enough for security to warn others,
• and users who improve after coaching.

Those are the behaviours that matter in a mature security culture.

Low report rates are often the most revealing result of all. If users do not know how to report, do not trust the reporting process, or assume someone else will handle it, the organisation loses early-warning visibility exactly when it needs it most. In that sense, the reporting workflow is a security control—not just an administrative step.

Practical sector scenarios

To make the results more concrete, here are three sector examples BCyber commonly sees reflected in simulation and fact-find work:

Financial services

Healthcare

Government

How education and coaching changed the pattern

Adaptive learning is where simulation becomes operationally useful.

If a user clicked a credential-harvest page, the follow-up should focus on:

• sender verification,
• link inspection,
• browser-domain awareness,
• and safe escalation habits.

If a team was caught by a fake invoice, the next lesson should focus on:

• payment approval workflows,
• supplier verification,
• out-of-band confirmation,
• and BEC red flags.

That is more effective than generic awareness content because it targets the actual behaviour that needs correction.

This is also where BCyber’s platform ecosystem adds value:

• Profiler supports behavioural analysis, insider-threat detection, access-pattern monitoring, and user activity analytics.
• Paradigm can map learning outcomes into governance, risk, and compliance automation, including policy automation and compliance mapping.
• Perfect Storm can simulate compound threat scenarios and test organisational resilience beyond a single lure.
• CyberTriage supports rapid incident response, helping teams triage reported threats in minutes and move from detection to containment.
• Privacy in Depth helps align simulation-driven learning with privacy obligations and control design.

BCyber’s learning content also strengthens the feedback loop. Courses such as Email Security Fundamentals for Australian Businesses, Secure Out-of-Band (OoB) Communication, Cyber-Safe Onboarding for New Staff, and Accountants and Tax Agents Cyber Security Practicality can be assigned based on the observed phish theme and the user’s role. That matters because role-based learning sticks better than one-size-fits-all training.

Alignment with recognised frameworks

Phishing simulation programs are strongest when they map to recognised frameworks rather than standing alone.

A mature program should support:

• NIST SP 800-50: security awareness and training lifecycle design
• NIST CSF 2.0: governance, identification, protection, detection, response, and recovery
• ISO/IEC 27001 / 27002: awareness, competence, and control effectiveness
• ACSC Essential Eight: practical hardening and privilege reduction
• APRA CPS 234: demonstrable information security capability and incident readiness

In operational terms, that means simulation results should feed governance, risk treatment, and control validation—not just HR training records.

BCyber credibility and industry recognition

BCyber’s experience in this space is reinforced by both platform maturity and external recognition. Karen Stephens, Co-Founder & CEO, was a 2025 Finalist – Cybersecurity Professional Of The Year, and BCyber was also named a 2025 GRC Provider of the Year — Finalist and 2025 AI Innovator - Cyber Security — Finalist. Those recognitions matter because they reflect not only market visibility, but sustained investment in practical, AI-enabled security improvement.

When those capabilities are combined with BCyber’s operational footprint—21 policies, 8 processes, 46 courses, 529 published articles, 365 knowledge hub entries, 9 clients, and 8 fact-find assessments—the result is a more trustworthy evidence base for phishing analysis and awareness improvement.

Turning results into action with BCyber tools

The practical goal is simple: turn simulation data into measurable risk reduction.

A typical improvement cycle looks like this:

1. Run a realistic simulation based on a business scenario.
2. Measure click rate, report rate, and time-to-report.
3. Assign targeted learning by user group or role.
4. Re-test with a refined scenario.
5. Compare the new result to the baseline.

That cycle works because it turns coaching into evidence. It also supports board and executive reporting: leaders can see whether reporting behaviour is improving, whether repeat campaigns are reducing susceptibility, and whether awareness is becoming a real control rather than an annual exercise.

In BCyber terms, the outputs can be surfaced through:

• GRACE Portal for executive visibility and compliance tracking,
• Profiler for behavioural risk scoring,
• Paradigm for policy and governance alignment,
• Perfect Storm for scenario testing,
• and CyberTriage for rapid incident handling when a real phishing message is reported.

Key takeaways

Phishing simulation results are most valuable when they tell a complete story about behaviour, reporting, and learning.

The main takeaways from Part 1 are:

• Click rate is only one signal. Report rate and time-to-report often reveal more about resilience.
• Low reporting is a visibility issue. Silence weakens the organisation’s early-warning capability.
• Targeted coaching works best. Role-based follow-up is more effective than generic awareness.
• Repeated simulations matter. They show whether behaviour change is durable.
• Framework alignment improves credibility. APRA CPS 234, Essential Eight, NIST, and ISO 27001 give the results governance value.
• Platform integration matters. When results flow into BCyber tools like GRACE Portal, Profiler, Paradigm, Perfect Storm, and CyberTriage, awareness becomes an operational control.

Phishing simulation results should therefore be treated as living evidence, not a scoreboard. They show where the organisation is resilient, where it is exposed, and where learning is already taking hold. For Australian organisations, that kind of evidence supports better decisions, stronger reporting, and tighter alignment with compliance expectations.

In Part 2, we’ll extend this analysis into deeper behavioural patterns, escalation paths, and broader operational response.

Selected references

• APRA CPS 234 – Information Security
• ACSC Essential Eight Baseline Maturity
• ACSC – Report and Recover: Phishing
• NIST SP 800-50 – Building an Information Technology Security Awareness and Training Program
• NIST Cybersecurity Framework 2.0
• ISO/IEC 27001 Information Security Management
• OAIC – Notifiable Data Breaches scheme