Phishing simulation metrics: what to measure, how to read them and which targets to set

By Kike Gandia · Co-Founder & CEO, OSCP

The metrics that really tell you whether a phishing simulation works are the reporting rate, the time to first report and the action rate —who goes on to submit credentials or open the attachment—, always read alongside the difficulty of the email sent. The click rate on its own says little: it depends on the pretext, it is inflated by security scanners that follow links and it cannot be compared with another company's. This guide covers each metric and its traps, how to rate difficulty with the NIST Phish Scale and how to build a dashboard for leadership.

Phishing campaign metrics at a glance

A simulation platform returns plenty of numbers. They are not all worth the same, and almost every one has a trap worth knowing before you show it to leadership:

Metric	How it is calculated	What it shows	Trap
Delivery rate	Emails delivered / sent	Whether the campaign reached inboxes	If filters block part of the send, the real denominator changes
Open rate	Opens / delivered	Little: it depends on a pixel being downloaded	Clients that block images push it down and those that preload them push it up
Click rate	People who clicked / delivered	Exposure to the first step of the lure	Security scanners that follow links; depends on pretext difficulty
Action rate	People who submitted credentials, opened the attachment or replied / delivered	The damage a real attack would have caused	You must define what counts as an action and keep it fixed across campaigns
Reporting rate	People who reported through the official channel / delivered	Defensive culture	Reports through unofficial channels that are never logged
Time to first report	Minutes from delivery to the first report	How long the organization takes to raise the alarm	With staggered sends, measure it from each batch's arrival
Report-to-click ratio	Reports / clicks	Whether people report more than they fall for it	With very few clicks the ratio spikes and stops meaning anything
Repeat clickers	People who fail several campaigns in a row	Where to focus targeted training	Using it to name or punish people destroys reporting
Response time after the report	From first report to containment: email pulled, domain blocked	Whether the report achieves anything	Only real if the SOC treats the report like any other incident
Results by department or profile	The metrics above by group	Where the risk sits: finance, HR, leadership	Small groups make individuals identifiable

Opens and clicks: how to filter out false data

The open rate is measured with an invisible pixel downloaded when the email is displayed, which makes it the least reliable metric of all. Many corporate email clients block external images by default, so someone can read the message without it registering as an open. The opposite also happens: Apple states that Mail's Protect Mail Activity downloads remote content in the background by default, even if the user never opens the email. A recorded open does not prove someone read the message, and a missing one does not prove they did not. The prudent choice is not to use it as a KPI.

The click rate has a similar problem: email gateways and security sandboxes follow the links in incoming messages to analyze them, and the simulation platform logs those visits as clicks. A campaign can rack up dozens of "clicks" that no person made. Signs that give away an automated click:

It arrives within seconds of delivery, before anyone could have read the email.
Every link in the message is hit at once, including a hidden one no human would see.
It comes from IP ranges or a user-agent associated with security vendors, not from the company's network or devices.
It is not followed by any interaction on the landing page.

To clean the data: include an invisible honeypot link and discard whoever visits it, exclude security vendors' IPs, require a minimal interaction on the landing page before counting a click and, above all, configure the exception your email platform provides for simulations. In Microsoft 365, for example, the advanced delivery policy stops Safe Links from blocking or detonating the URLs in third-party simulation messages. In the report, always separate raw clicks from cleaned clicks and explain the criteria, so the figure can be audited and compared with the next campaign.

Click, action and report: three different questions

Each of the three core metrics answers a different question, and mixing them up leads to the wrong conclusions:

Click rate: how many people fall for the first step of the lure? It measures exposure, not damage. A click on the link of a credential theft campaign compromises nothing on its own.
Action rate: how many people complete what the attacker wanted —typing their password into a fake page, opening the attachment, enabling macros, replying with data? It is the metric closest to real risk and the one to watch for people who approve payments or administer systems.
Reporting rate: how many people alert the security team through the official channel? It measures defensive culture, and it is the only one of the three that turns employees into sensors.

Published data points the same way. The 2025 Verizon Data Breach Investigations Report, drawing on more than 100,000 simulation campaigns, found that users with recent training reported simulated emails around 21% of the time, against a base rate of 5%. Their click rate, by contrast, barely improved —a 5% relative change— and the median click rate stayed at 1.5% even after training. Training moves reporting far more than clicking.

That is why someone who clicked and then reported should count as a positive: it is exactly the behavior that lets you contain a real attack in time. A report-to-click ratio above 1 means the organization reports more than it falls for the lure.

Time to first report and response time

A report is only useful if it arrives early and someone acts on it. That is why the two time metrics are the best measure of real defensive capability:

Time to first report: minutes from the email landing in inboxes to the first report through the official channel. In a real attack, that first report is what lets you pull the message from every other mailbox before more people fall for it. It is also worth tracking the median time to report, to see whether reports cluster in the first minutes or trickle in over the day.
Response time after the report: from the first report until the SOC or IT team triages it, pulls the email from mailboxes and blocks the domain or URL. This is the metric that connects awareness with incident response.

Measuring the second one requires a design decision. If the security team knows a simulation is running, its response time means nothing; if it does not, you need someone in the know to prevent an unnecessary escalation. Platforms also tend to handle simulation reports in a special way: in Microsoft 365, when someone uses Outlook's built-in Report button on a message identified as a simulation in the advanced delivery policy, no alert, investigation or incident is generated. If you want to measure the SOC's response, plan how that report reaches its queue.

An organization with some clicks, but a first report within minutes and the email pulled shortly afterwards, is in better shape than one with no clicks and no reports at all.

Why the click rate alone misleads: the NIST Phish Scale

Two campaigns with the same click rate can mean opposite things. A 10% click rate on a generic email full of mistakes is bad news; 10% on an email that mimics a real internal process, in the very week that process happens, can be a good result. Without a measure of the email's difficulty, the click rate can be neither interpreted nor compared.

That measure exists. NIST developed the Phish Scale from real simulation data, published it as research in 2019 and 2020 and, in November 2023, turned it into a practical guide: NIST Technical Note 2276. It rates how hard an email is to detect using two components:

Cues: the observable signs that the email is fraudulent, in five types: errors, technical indicators (sender, links, look-alike domains), visual presentation, language and content (urgency, threats, requests for data) and common tactics. They are counted: 1 to 8 cues is few (harder), 9 to 14 some, and 15 or more many (easier).
Premise alignment: how well the pretext fits the work and context of the recipient. Five elements are scored from 0 to 8: whether it mimics a real workplace process, whether it is relevant to the role, whether it matches a current event, whether it raises concern over the consequences of not acting and, subtracted, whether the group has had training or warnings about this kind of lure. A score of 10 or less is weak alignment, 11 to 17 medium and 18 or more strong.

The two components combine in a detection difficulty matrix:

Cues	Strong premise	Medium premise	Weak premise
Few (1-8)	Very difficult	Very difficult	Moderately difficult
Some (9-14)	Very difficult	Moderately difficult	Moderately to least difficult
Many (15 or more)	Moderately difficult	Moderately difficult	Least difficult

The practical rule is simple: rate every template before sending it, always publish the click rate alongside its difficulty and only compare campaigns in the same category. NIST's own guide notes that an unexpected result —lots of clicks on a least difficult email— suggests that group needs different or additional training. One practical detail: NIST states that the Phish Scale is free for academic use and that commercial use requires a license from NIST.

Industry benchmarks: context, not a target

The question "what click rate is normal?" has published answers, but very different ones, because each report measures something else:

Source	What it publishes	What it actually measures
KnowBe4, 2025 Phishing by Industry Benchmarking Report	Baseline Phish-prone Percentage of 33.1%, falling to 4.1% after 12 months of training	Users of its platform (14.5 million across 62,400 organizations) before and during its program, with its templates
Verizon DBIR 2025	Median click rate of 1.5%, and 21% reporting with recent training against a 5% base	More than 100,000 simulation campaigns from different organizations, measured per campaign and as a median

The gap between 33% and 1.5% is not a contradiction: one figure describes a vendor's users before they start training, the other the median campaign of organizations that already run simulations. Before comparing your result with a benchmark, check at least:

The population: untrained staff, or years into a program?
The unit and the statistic: people or campaigns? Mean or median?
What counts as a failure: only the click, or any interaction with the email.
Template difficulty, which no report publishes on a common scale.
Filtering of automated clicks, which can move the result by several points.

Benchmarks are useful to set the order of magnitude and to explain to leadership that no organization's risk is zero. The yardstick that matters is your own baseline, measured at comparable difficulty over time.

How to build a dashboard for leadership

A leadership committee has no use for the simulation platform's export. What it needs is three to five indicators, with their trend and one sentence on what they mean. A selection that works:

Reporting rate, as the headline indicator.
Time to first report and time to containment after the report.
Action rate (credentials or attachments), with critical profiles shown separately: finance, system administration and leadership.
Repeat failure rate: percentage of people who failed two or more of the latest campaigns, without names.
Difficulty of each campaign on the Phish Scale, as mandatory context for everything above.

Illustrative example of a quarterly view (the figures are made up to show the format; they are not reference values):

Indicator	Q1	Q2	Q3	Q4	Reading
Difficulty (NIST Phish Scale)	Moderate	Moderate	Very difficult	Very difficult	Difficulty raised in Q3
Reporting rate	9%	14%	18%	24%	Steady improvement
Time to first report	41 min	22 min	12 min	6 min	The first report arrives sooner
Action rate	6%	4%	7%	5%	Rises when the pretext gets harder, then falls again
Repeat failure rate	—	3%	3%	2%	Small group with targeted training

Three rules so the dashboard tells the truth: always show the trend rather than a snapshot, explain any jump caused by a change in difficulty before someone reads it as a setback, and only break data down by department in groups large enough that nobody can be identified.

Which targets to set (and which not to)

A "0% click rate" target looks good in a slide deck and is bad for security. With hard enough pretexts someone always clicks —the DBIR puts the median at 1.5% even after training— and chasing zero pushes teams to send ever easier emails so the number works out. Targets that do make sense:

Raise the reporting rate campaign after campaign, at equal or higher difficulty.
Cut the time to first report and the time to containment, which are what limit the damage of a real attack.
Lower the action rate in critical profiles, because that is what turns into stolen credentials or fraudulent transfers.
Reduce repeat failures with targeted training and support, not sanctions.
Raise the difficulty as results improve, warning leadership beforehand that the click rate may go up.

Set targets against your own baseline —for example, "double the reporting rate in a year" or "first report within 15 minutes"— and not against the average of a report that measures a different population with different templates.

Mistakes that invalidate the metrics

Most programs that "don't improve", or improve suspiciously fast, have one of these measurement problems:

Comparing campaigns of different difficulty: a drop in clicks after switching from a hard email to an easy one is not an improvement.
Rewarding "zero clicks" with easy pretexts or the same template repeated until employees recognize it.
Naming individuals: named rankings, notifying their manager or sanctions. People stop reporting out of fear, and reporting is exactly what you wanted to measure.
Counting automated scanners as clicks, which inflates the rate and hides any real improvement.
Measuring once a year: an annual campaign gives a snapshot, not a trend, and any change may be down to the pretext or the timing chosen.
Sending everyone the same email at once: colleagues warning each other, desirable in a real attack, distorts the simulation result. Staggering sends and varying templates reduces it.
Changing the denominator: calculating sometimes on emails sent and sometimes on emails delivered, or not removing inactive mailboxes.
Announcing the campaign: saying "there's a simulation this week" measures people's memory of the template, not their judgment.

Metrics as evidence for ISO 27001 and NIS2

Simulation metrics are also compliance evidence, as long as they are presented as part of a program and not as a standalone figure:

ISO/IEC 27001:2022 requires awareness in clause 7.3 and includes control 6.3 in Annex A, on information security awareness, education and training. Clause 9.1 also requires monitoring, measurement, analysis and evaluation. An auditor will expect to see an awareness plan, campaign records, aggregated results with their trend and the actions taken because of them.
NIS2 lists basic cyber hygiene practices and cybersecurity training among the risk management measures in Article 21(2)(g), and Article 20(2) provides that members of management bodies are required to follow training. A dashboard with a trend is a direct way to show that training happens and is evaluated.

Aggregated results are enough for these purposes: neither the standard nor the directive asks for lists of who clicked. How to handle individual data without clashing with the GDPR or employment law is covered in our article on whether phishing simulations are legal.

FAQ

What is an acceptable phishing simulation click rate?

There is no universal figure, because the click rate depends mostly on how difficult the pretext is. Published reports range from a 1.5% median per campaign (Verizon DBIR 2025) to a 33.1% baseline before training (KnowBe4 2025), because they measure different things. What helps is comparing yourself with your own baseline at similar difficulty and looking first at the reporting rate and the time to first report.

What is a good reporting rate?

There is no official threshold either: what matters is that it rises steadily. As a reference, the Verizon DBIR 2025 found around 21% reporting among users with recent training, against a 5% base rate. If your reporting rate is higher than your click rate, the organization reports more than it falls for the lure, which is the signal you are after.

How do I tell a real click from a security scanner?

Automated clicks usually arrive within seconds of delivery, hit every link at once —including a hidden one— and come from security vendors' IPs or user-agents. You filter them with an invisible honeypot link, by excluding those IPs, by requiring a minimal interaction on the landing page and with your email platform's exception for simulations. In the report, separate raw clicks from cleaned ones.

How often should we measure?

Often enough to see a trend: at least two or three campaigns a year, and ideally quarterly. A single annual campaign gives a snapshot that depends too much on the pretext and timing chosen, and it cannot tell you whether the program is improving.

Should results be reported per person?

Not to leadership: the dashboard should be aggregated, by department or profile, in groups large enough that no one can be identified. Individual data only makes sense to offer targeted training, with restricted access. We cover the legal limits in our article on whether phishing simulations on employees are legal.

What is the NIST Phish Scale?

It is a NIST method for rating how hard a phishing email is to detect, combining the number of suspicious cues it contains with how well its pretext fits the recipient's work. It rates each email from least to very difficult and makes fair comparisons between campaigns possible. Its user guide is NIST Technical Note 2276, from 2023, and NIST states that commercial use requires a license.

What is the phish-prone percentage?

It is KnowBe4's name for the percentage of employees likely to fall for a simulated phishing email, calculated on its platform. Its 2025 report puts the baseline at 33.1% before training and 4.1% after a year. It works as an order-of-magnitude reference, but it is not directly comparable with the click rate of a campaign run with other templates and another definition of failure.

Sources

Design a phishing campaign with comparable metrics