Phishing Simulation Results: What They Really Tell You About User Risk and Security Awareness

By BCyber Security Team | CISSP, CISM Last updated: 2 October 2026

Phishing simulation results are only useful when they show more than a click rate. The real question is: who was targeted, what behaviour changed, what evidence was captured, and what happened next? If the results feed training, risk reporting, and control improvement, they become an education asset. If they only produce a score, they are just a headline with no operational value.

In our work across 11 clients, including organisations operating under APRA CPS 234, the Essential Eight, and privacy obligations aligned to the Australian Privacy Act 1988, the most meaningful phishing simulation programs are the ones that connect human behaviour to control performance. BCyber’s platform inventory — including 23 policies, 9 processes, 50 courses, 959 published articles, 542 knowledge hub entries, and 14 fact-find assessments — reflects that same principle: awareness content only matters when it changes decisions, reporting behaviour, and response readiness.

If you are trying to make sense of phishing simulation results, the safest place to start is with behaviour, not blame. A low click rate can look reassuring while reporting remains poor, and a high click rate can still be useful if it exposes gaps that your team can fix. The better question is not “Who failed?” but “What did this reveal about our people, our process, and our controls?” That shift turns simulation data into something that can actually improve resilience.

What phishing simulation results actually are

Phishing simulation results are the measured outcomes of a controlled email, SMS, chat, or collaboration-based social engineering exercise used to test user awareness and organisational readiness. They are not just a pass-or-fail score, because a simulation can expose whether users noticed the lure, whether they trusted the sender, whether they reported it, and whether the organisation responded well.

For B2B security teams, the most useful interpretation is control-based: did the simulation test user judgment, reporting workflows, mailbox controls, or all three? A well-designed simulation should be mapped to an operating framework such as NIST CSF 2.0, ISO/IEC 27001:2022, or the ASD Essential Eight, so the result can be tied back to governance, people, and technical safeguards.

At BCyber, that alignment is typically reinforced through:

• GRACE Portal for consolidated monitoring, executive reporting, and compliance tracking
• Profiler for behavioural intelligence, user profiling, and access pattern monitoring
• Paradigm for policy automation and compliance mapping
• CyberTriage for rapid containment and triage if a test exposes a real incident
• Perfect Storm for scenario modelling when phishing is part of a broader attack chain

What a complete result set should include

A meaningful phishing simulation record normally captures more than one outcome. It should show who received the simulation, who opened it, who clicked, who submitted credentials or data, who reported it, and how quickly that report reached the right team. It should also show whether the same users repeated the behaviour after training, because repeat outcomes often say more than a first attempt.

In regulated environments, we also recommend noting:

• delivery success and inbox placement
• whether the message bypassed secure email gateway controls
• user action by role, location, or business unit
• report rate and time-to-report
• post-campaign coaching completion
• repeat behaviour across campaigns

When the results are segmented by business unit, role, device, or campaign theme, they become much easier to interpret. That is where the data starts to resemble a living picture of user risk rather than a flat scorecard.

Why a click rate alone is incomplete

A click rate tells you that someone interacted with a message, but it does not tell you why they did it or what happened after the click. It does not show whether the user reported the message, whether they entered credentials, or whether a technical control prevented anything further. It also hides the difference between a user who clicked and immediately reported the test, and a user who clicked, ignored the warning signs, and repeated the same behaviour later.

That distinction matters in sectors like:

• Financial services, where a simulated invoice or payment redirection lure may reflect real business email compromise risk
• Healthcare, where a lure around patient records or clinical rosters may indicate pressure, time sensitivity, and mobile use
• Government, where fake policy updates, HR notices, or secure portal messages can test trust in internal communications

A low click rate can also be misleading. If users are not reporting suspicious messages, the organisation may still be vulnerable even when the headline number looks good. Some campaigns measure familiarity with a style of message rather than resilience under real pressure, especially when users have seen similar templates before.

How simulation results fit into a broader security strategy

Phishing simulation results should sit inside a wider security program, not float on their own. Awareness training is one layer, but reporting behaviour and technical detection are equally important. If a simulation result reveals a gap in reporting, that information should feed into help desk processes, incident handling, and alert routing. If a simulation reveals that a certain lure theme works well, that can inform both awareness content and email filtering rules.

This is why BCyber commonly links simulation findings to:

• BCyber policies on acceptable use, information security, and incident reporting
• BCyber processes for triage, escalation, and corrective action
• BCyber courses on phishing awareness, secure communication, and human risk reduction
• GRACE Portal executive reporting so risk can be tracked over time

A useful simulation result is not the one that looks best on a slide. It is the one that changes what the organisation does next.

Which phishing simulation metrics actually matter?

The most useful phishing simulation metrics are the ones that show exposure, engagement, reporting, and change over time. A simulation that only measures clicks is like checking one tree in a forest and calling it the whole ecosystem. You want to know who saw the message, how they behaved, whether they escalated it, and whether their behaviour improved after intervention.

The most defensible metric set usually aligns to common assurance frameworks:

• NIST: detect, respond, and recover implications
• ISO 27001: awareness, training, and continuous improvement
• Essential Eight: user behaviour and controls that reduce exploitability
• APRA CPS 234: information security capability and control assurance

Exposure and delivery metrics

Delivery metrics tell you whether the simulation actually reached the audience you think it reached. If messages landed in spam, were blocked, or were filtered differently across teams, then the comparison between groups may not be fair. Inbox placement matters because exposure shapes behaviour, and behaviour shapes the result.

Useful exposure questions include:

• How many users received the simulation?
• Did the message reach the inbox or get filtered?
• Was the simulation delivered consistently across platforms?
• Did any group have a different exposure level?
• Did secure email controls alter delivery in a way that affects interpretation?

In practice, BCyber teams often use GRACE Portal dashboards and TopSpin trend analysis to separate delivery noise from actual user behaviour.

Engagement metrics

Engagement metrics show how users interacted with the lure once it arrived. Open rate can be useful, but it often matters less than click rate, submission rate, and attachment interaction. If a user clicks a link but does not submit data, that is a different risk from a user who enters credentials or uploads a form.

Important engagement measures include:

• open rate
• click rate
• attachment interaction rate
• link interaction rate
• credential submission rate
• form submission rate

For security teams, credential submission is often the critical threshold because it indicates a higher likelihood of account compromise, MFA prompt fatigue, or session hijack if the campaign were real.

Reporting and escalation metrics

Reporting behaviour is one of the clearest signs of resilience. A user who spots something suspicious and reports it quickly has created an early warning signal for the rest of the organisation. The time-to-report matters because speed affects how quickly the SOC, help desk, or security lead can contain a real issue.

This is where CyberTriage becomes relevant. If a phishing simulation reveals delayed reporting, then a real incident may also be delayed, increasing dwell time and investigation cost. A mature program should measure:

• report rate
• time-to-report
• correct channel usage
• escalation completeness
• whether the report triggered the intended workflow

Behaviour change metrics

Behaviour change is where simulation results become genuinely valuable. If users improve after coaching, targeted training, or awareness messaging, then the simulation has done more than test them. It has changed the pattern of risk.

Repeat clickers, repeated credential submissions, and slow reporters all point to areas that need follow-up, but they should be treated as signals for support rather than punishment. The aim is to reduce real-world exposure, not to shame people into silence.

A strong behaviour-change view usually looks at:

• repeat failures after training
• improvement across multiple campaigns
• reduced risky actions over time
• stronger reporting after awareness efforts

How should you interpret phishing simulation results correctly?

Phishing simulation results only become meaningful when they are read in context. A number on its own cannot tell you whether the audience was highly targeted, whether the lure was especially believable, or whether a technical control altered the outcome. Two campaigns with the same click rate can mean very different things depending on who was tested and how the simulation was designed.

Why context changes the meaning of the numbers

Different groups face different threat profiles, so their results should not be treated as interchangeable. Finance teams, executive assistants, and HR staff may be targeted by lures that resemble invoices, approvals, or payroll messages, while IT teams may be targeted by admin-style requests or internal service prompts. New starters may also react differently from long-tenured staff because they have less organisational context and less pattern recognition.

In Australian regulated sectors, this matters because:

• APRA CPS 234 expects organisations to maintain information security capability and test control effectiveness
• the Essential Eight expects practical, layered mitigation against common attack paths
• the Australian Government Information Security Manual (ISM) and ACSC guidance emphasise user awareness as part of a broader control stack

A better interpretation asks:

• Was the audience likely to be targeted by this theme in real life?
• Were there recent training sessions that could affect the result?
• Did the simulation match the users’ roles and responsibilities?
• Did any technical control influence the exposure?

Distinguishing awareness from resilience

Awareness and resilience are related, but they are not the same thing. Awareness means the user recognised that something looked suspicious, while resilience means they took the right action after recognising it. A user can be aware and still click out of habit, curiosity, or distraction.

That is why BCyber’s Profiler platform is useful in this context: it helps identify patterns such as repeated risky interaction, access anomalies, and behavioural drift over time. Combined with GRACE Portal, it gives leaders a more complete picture than a one-off campaign report.

Comparing campaigns over time

One campaign can create a snapshot, but trends create understanding. If you only look at a single simulation, you may overreact to a bad result or overstate a good one. Multi-campaign comparison helps you see whether targeted training, messaging, or process changes are having the effect you expected.

This is also where the BCyber CyberSuite ecosystem supports continuous improvement:

• Paradigm can map training outcomes to policy and compliance obligations
• TopSpin can identify seasonal or business-cycle patterns
• Perfect Storm can model how phishing fits into compound cyber threat scenarios

What good results can still hide

Good-looking results can still mask blind spots. Users may click but never submit data, which is better than credential theft but still not ideal. They may avoid clicking but fail to report the message, which means the organisation loses an opportunity to stop a real campaign early. A campaign may also measure familiarity with a particular template rather than real-world resistance to a new tactic.

Good numbers should therefore be read alongside:

• reporting latency
• escalation quality
• repeat behaviour
• the presence of compensating controls such as MFA, URL filtering, and attachment detonation

What do phishing simulation results reveal about user behaviour?

Phishing simulation results are one of the clearest ways to observe how people actually behave under mild pressure. They show whether users slow down, verify identities, inspect links, and follow reporting procedures, or whether they react quickly and automatically. They also reveal habits that are hard to see in training sessions, such as overconfidence, distraction, or reliance on brand recognition.

Common behavioural patterns

Some users click because they are curious, especially when the lure promises a document, login update, or urgent task. Others respond because the message creates pressure, time sensitivity, or fear of missing something important. Brand impersonation can also work when the message resembles a trusted supplier, internal system, or government service.

In practice, we often see:

• finance staff reacting to payment-related language
• healthcare staff responding to roster, compliance, or patient workflow themes
• government employees interacting with internal policy or service notifications

Departmental and role-based patterns

Different roles tend to attract different lure types, and the results often reflect that. Finance teams may be more exposed to invoice fraud, payment requests, and document sharing prompts. HR teams may be targeted with personnel records, leave forms, or payroll themes. IT teams may see internal admin messages, password requests, or cloud service notifications.

This is why segmenting by role matters. A single enterprise-wide average can hide the fact that one group is performing well and another is exposed. A GRACE Portal executive dashboard can help surface those differences without making the reporting process unwieldy.

Repeated behaviour and training resistance

Repeated failure is worth taking seriously, but not because it proves someone is careless. It may show that the training format is not sticking, that the role is under unusual pressure, or that the user has not yet developed a reliable verification habit. The right response is usually more targeted coaching, not embarrassment.

BCyber’s 50 courses and two current enrollments give teams a practical way to pair simulation outcomes with role-based learning. For example, a user who repeatedly falls for credential harvesting may benefit from a focused course on:

• phishing indicators
• URL inspection
• MFA fatigue attacks
• reporting workflows
• safe handling of suspicious messages

Positive behaviours worth measuring

It is easy to focus on failure, but positive behaviour matters just as much. Prompt reporting, careful checking, and colleagues warning each other about suspicious messages all strengthen resilience. Internal verification before action is also a strong indicator that security habits are becoming part of normal work.

If awareness content is working, you should expect to see more users pause, ask, and confirm before they respond. Those are small acts, but they scale across the organisation.

How do you turn simulation results into better training and controls?

Phishing simulation results matter most when they change what happens next. If the numbers stay in the report and never reach training, security operations, or policy review, then the organisation has learned very little.

Using results to personalise security awareness training

The most effective training is specific. If a group repeatedly falls for invoice-themed lures, then the next training should address invoice verification, sender scrutiny, and payment workflow checks. If a team fails on mobile-based phishing, then the training should reflect mobile behaviour rather than only desktop email.

BCyber’s content model supports this approach through:

• targeted courses
• role-specific policies
• process-driven reinforcement through 9 processes
• article-based reinforcement across 959 published articles and 542 knowledge hub entries

Turning results into coaching opportunities

Simulation results should support learning, not humiliation. Individual coaching can be helpful when it is respectful, private, and tied to a clear improvement path. Broad punitive approaches often make people less likely to report suspicious messages in the future, which defeats the purpose.

For government and healthcare clients, we commonly recommend documenting the coaching in a way that supports privacy obligations and internal fairness principles, while still creating an audit trail for improvement. That aligns well with the privacy-by-design thinking behind Privacy in Depth.

Improving detection and response controls

The same data that informs training can also improve detection and response. If users repeatedly encounter a certain lure style, email filtering rules and detection logic can be tuned to recognise similar patterns. If reports are slow or inconsistent, the reporting workflow may need simplification or better alert routing.

This is where CyberTriage is useful for testing the downstream incident response workflow. A phishing result should not only ask, “Did someone click?” It should also ask:

• Did the user report it?
• Did the SOC acknowledge it?
• Was triage completed within target time?
• Were indicators shared with the right stakeholders?
• Did containment controls trigger correctly?

Using results to prioritise risk mitigation

Not all risks need the same response. High-risk groups, recurring lure types, and repeated failures should influence where you invest time first. If a finance team consistently receives invoice-themed tests and struggles with them, that deserves a more focused response than a broad one-off reminder.

That prioritisation is particularly important in APRA-regulated environments, where control testing and remediation evidence matter. The same applies to organisations measuring against the Essential Eight, where maturity improvements should be demonstrable rather than assumed.

What are the most common mistakes in reading phishing simulation results?

The most common mistake is treating a single metric as the whole story. A click rate can look dramatic, but without reporting data, exposure context, and repeat behaviour, it does not tell you much. Another frequent error is using simulations as a punishment tool, which usually reduces trust and suppresses reporting.

Overreliance on vanity metrics

Vanity metrics can make a report look complete while leaving the real question unanswered. A low click rate might seem reassuring, but if users are not reporting suspicious messages, the organisation still has a problem. Submission rate and time-to-report often matter more than a simple click number because they show the likely impact on real-world incidents.

Using simulations as a punishment tool

If users believe simulations are designed to embarrass them, they may hide mistakes rather than report them. That creates a culture of silence, which is the opposite of what security awareness is meant to build. People learn more effectively when the process feels fair, specific, and constructive.

Comparing unlike campaigns

Campaigns should only be compared when the conditions are reasonably similar. Different audiences, different lure difficulty, different timing, and different delivery channels can make one campaign look better or worse than another for reasons that have nothing to do with actual resilience.

Ignoring limitations and false positives

No simulation is perfect. Some users recognise the style of the test because they have seen the template before, while technical filters may alter who receives the message. Accessibility issues can also affect engagement, especially when the simulation is not designed with different devices and needs in mind.

A trustworthy report should clearly state:

• whether the campaign was announced or unannounced
• whether delivery controls may have changed exposure
• whether users had recently completed training
• whether the data is representative of the whole population

How should you present phishing simulation results to leadership?

Leadership usually does not need more raw numbers; it needs a clearer picture of risk and progress. That means translating simulation results into language about exposure, trend, resilience, and follow-through. Executives want to know whether the organisation is improving, which groups need attention, and whether reporting behaviour is becoming more reliable.

What executives usually want to know

Most leaders care about whether people are getting better over time, where the highest concentration of risk sits, and whether suspicious messages are being reported quickly enough. They also want to know whether the organisation is responding to findings or merely measuring them.

A simple narrative often works best:

1. what was tested
2. who was most exposed
3. what behaviour changed
4. what was done next
5. how the trend compares to prior campaigns

Reporting formats that work

Dashboards, trend charts, and department heat maps are often the easiest ways to present results. Executive summaries can help if they stay focused on a few clear points and avoid technical clutter. Risk-based scorecards are useful when they connect simulation results to broader security priorities, such as reporting performance or repeat behaviour.

BCyber’s GRACE Portal is designed for exactly this kind of visibility, bringing together single-dashboard oversight, cross-product analytics, executive reporting, compliance tracking, and real-time monitoring.

How to communicate results without creating blame

Blame tends to shut people down, while learning opens them up. If the message is framed around organisational improvement, people are more likely to engage with the findings honestly. That does not mean softening the data; it means presenting it in a way that supports action.

BCyber’s evidence-led approach

BCyber’s approach to phishing simulation analysis is grounded in combined governance, behavioural, and operational data. That matters because phishing is rarely just an awareness issue. It is a people, process, and control issue.

Relevant BCyber capabilities include:

• GRACE Portal for visibility, executive reporting, and compliance tracking
• Paradigm for policy automation and compliance mapping
• Profiler for behavioural risk analysis and insider-risk indicators
• CyberTriage for rapid triage and containment
• Perfect Storm for scenario modelling and resilience testing
• TopSpin for trend analysis and forecasting

BCyber has also been recognised as:

• 2025 Finalist Cybersecurity Professional Of The Year — Karen Stephens, Co-Founder & CEO
• 2025 GRC Provider of the Year — Finalist
• 2025 AI Innovator - Cyber Security — Finalist

These recognitions matter because they reflect a broader commitment to practical, risk-based cyber programs rather than awareness theatre.

Key Takeaways

Phishing simulation results are most valuable when they show behaviour, context, and follow-through rather than a single click rate. A good result set includes exposure, engagement, reporting, time-to-report, repeat behaviour, and trends across teams or roles. Interpretation should always account for audience, threat realism, campaign design, and prior training.

The strongest programs use the findings to refine awareness training, improve reporting workflows, and tune technical controls. When simulation data is treated as a living feedback loop, it helps the organisation become more resilient over time.

Verification statement: Statistics, platform counts, and BCyber capability references in this article were cross-checked against BCyber internal platform inventory data current at the time of publication. This article is educational content only and does not guarantee security, compliance, or risk outcomes. It is not legal or financial advice.

Regulatory note: This article is general information only. BCyber is not a law firm. Always verify obligations against primary sources, including the Privacy Act 1988, APRA CPS 234, the ACSC Essential Eight, and relevant organisational policy. Content is AI-assisted and human-reviewed.

Helpful government and industry references

• APRA CPS 234: https://www.apra.gov.au/cps-234-information-security
• ACSC Essential Eight: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
• ACSC Information Security Manual: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism
• NIST CSF 2.0: https://www.nist.gov/cyberframework
• NIST SP 800-53: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
• ISO/IEC 27001 overview: https://www.iso.org/isoiec-27001-information-security.html

If you want, I can also produce:

• a shorter executive version
• a CISO briefing version
• a version tailored to APRA-regulated organisations
• or a BCyber-branded landing page version