Is Your Phishing Training Changing Behavior or Just the Click Rate?

Picture the monthly security report: clicks down again, a green arrow on the slide, and nobody asks how long the real phishing email sat in six inboxes before someone flagged it. In my view, a falling click rate can also mean people have learned to ignore email. It counts who touched the lure and says nothing about who told anyone.

If you have presented that slide, you know the pause when someone asks whether your phishing training is changing behavior or only the number. The trend line is honest. It just answers a smaller question than the one being asked in the room.

Phishing training that changes behavior practices the report itself, quickly and without blame, and puts the click rate next to how long the first report took. Below is a one-page brief you can fill in this week, before your next simulation goes out.

Key takeaways

• A falling click rate describes how people handled particular simulated emails, and because click rates rose with lure difficulty in a large 2025 study, it can't show on its own that your people are safer.
• In my view, the behavior that protects the company is a fast, accurate report, because that is the moment someone can start containing a real phishing email.
• Read the click rate next to time to first report and report quality, and treat fewer clicks without faster reports as an unexplained drop.
• In a 2024 experiment at one large corporation, five weeks of practicing skills with feedback in day-to-day work improved reporting of malicious test messages for up to 12 months.

What does a falling click rate actually tell you?

Less than the slide suggests. A click rate describes how people handled particular simulated emails on particular days, and it goes up and down with how hard the lure was.

In a 2025 preprint by Andrew Rozema and James Davis of Purdue University, a reproduction study with a sample of 12,511 at a US-based financial technology firm, lures were rated with the NIST Phish Scale. Click rates increased from 7.0% on easy lures to 15.0% on hard lures.

7.0% to 15.0% was the rise in click rates from easy to hard lures in Rozema and Davis's 2025 preprint, a sample of 12,511 at a US-based financial technology firm.

So a month of gentler lures can produce a green arrow all by itself. (The arrow never mentions which kind of month it was.)

The same study found no significant main effect of the training interventions on click rates or reporting rates, and the authors read that as confirming that current training approaches don't work. It's a preprint from one firm, so I'd take it as a serious warning about the approaches tested there. What a different design would do in your company is a question it can't answer.

I'd call fewer clicks with no second signal an unexplained drop. The lures may have been easier, or people may have started skipping email altogether, and the click rate can't tell you which.

Why is the report the behavior phishing training should change?

Because, in my view, a report is how a real phishing email gets contained. A click nobody mentions leaves the message sitting in other inboxes, while an early report gives the security team something to act on.

It's the same reason compliance rules break under pressure: the behavior that counts happens at someone's desk on a busy afternoon, long after the module ended.

Reporting also looks trainable. In a 2024 experiment published in Frontiers in Psychology, Deanna Caputo, Lura Danley and Nathaniel Ratcliff of The MITRE Corporation studied employees of a large corporation serving national security needs over 12 months.

Half the participants got a skills-based training that let them practice over five weeks and get feedback on their performance in their day-to-day work. It improved reporting of malicious elicitations, test messages sent by email and text, for up to 12 months.

For reading the two signals side by side, I use a rule of thumb of my own. None of it comes from a study.

• Clicks down, reports up: The behavior may be changing, so check whether the reports are useful.
• Clicks down, reports flat: Treat it as unexplained, since the lures may have been easier or people may be skipping email.
• Clicks flat, reports up: People may be catching lures by reporting them, so keep the practice going.
• Both flat: The practice isn't reaching the moment, so redesign it.

How do you design phishing simulations that people will report from?

Treat each simulation as practice of the report: an easy report step, feedback for everyone the same day, and no blame. The research on phishing training is mixed, so measure whether reporting actually speeds up.

Diego Madeira and Carina Alves, in a study published in August 2026 in the International Journal of Human-Computer Studies, combined interviews with a quantitative phase of 4,457 employees. They found that immediate feedback reduces susceptibility to phishing, and that mandatory participation raises engagement but may affect intrinsic motivation. They measured susceptibility, which leaves reporting an open question.

Blame needs a decision of its own. In a simulation at a German university hospital that targeted 7,044 email accounts, Jan Tolsdorf, David Langer and Luigi Lo Iacono found in surveys that some people reacted with fear, shame, guilt and hostility, which the authors see as an ethical challenge of such simulations.

That's why I'd skip the repeat-clicker list. The study didn't measure reporting, but my guess is that someone ashamed of one click will be slower to mention the next.

• Instead of: Sending clickers a remedial module and a note to their manager.
• Try: A short debrief for every recipient the same day that shows the cues in the email and walks through the report step.

Then check the plumbing. If the report button sits two menus deep or reports vanish into an inbox nobody answers, people will delete instead, and no module fixes that. Before you build anything, take an hour for diagnosing whether it's really a training problem.

What does a report-first brief look like when it's filled in?

One page that names the report as the behavior, its moment, what you can observe, a baseline, the practice and who watches when.

Picture a clinical operations coordinator at a pharmaceutical company (a composite). It's Thursday afternoon, she's halfway down a spreadsheet, and a message that seems to come from a trial site contact asks her to log in and view an updated protocol document. The sender's address is slightly off and the wording a little rushed, so she pauses.

In one version, she isn't sure security wants to hear about every odd email, and the report option is two menus deep. She deletes it, while two colleagues who already opened it say nothing.

In the other, she presses the one-click report button she has practiced in earlier simulations, gets an automatic thanks and later a short note from a person saying whether it was real. Security has the message early, and at the next huddle her team lead calls it a good catch.

Here is her brief. Every detail is hypothetical, so swap in your own roles, systems and wording.

1. Behavior: When a message asks her to log in, open a file or change payment details and something feels off, she reports it with the report button before doing anything else with it.
2. Real moment: Thursday afternoon, mid-spreadsheet, a message that appears to come from a trial site contact asks her to view an updated protocol document.
3. Signs of success: Reports arrive the same working day and say in the person's own words what felt off. People who clicked also report, and nobody forwards the message to colleagues instead.
4. Baseline: From the last campaign and from real suspicious-email reports, write down how many were reported, the time from delivery to first report and how useful the reports were. If you can't get the data, say so and let the next wave be the baseline.
5. Practice: Build the report step into every simulation and end each wave with a same-day debrief for everyone who received it, clickers included. Keep it free of blame and ask one question: “What made you look twice, or not?”
6. Who watches and when: The owner of the security inbox records time to first report and report quality, and team leads ask at the huddle who reported something that week. Check about three weeks after the first wave and again at 90 days, the rhythm from how to measure what changes after training. If clicks fall while time to first report doesn't, change the practice before you report a win.

In our Behavior Bridge method, that first line is the job of the Behavioral Brief, the one-page deliverable of the Define the Behavior phase that turns a vague request into one behavior with a measurable goal.

What if you can't get the data, or the program is mandatory anyway?

Start with whatever data you can get and keep the mandatory module. What changes is what the simulation practices and what sits beside the click rate.

“Security owns the platform, and I can't get the report data.” Fair enough, it's their system. Ask for the report events, their timestamps and the outcome of each report from the last wave; if those can't be shared yet, your next wave becomes the baseline.

If the course is mandatory and already built, keep it. Madeira and Alves found that mandatory participation raises engagement but may affect intrinsic motivation, so I'd spend the design effort on the practice and the same-day debrief, where people actually rehearse the report.

When your CISO and the board ask for the click rate, give it to them with time to first report and report quality beside it. Tell them plainly that the research is mixed and that no single study settles the question for your organization.

Next month, that green arrow can sit beside how long the first report took and how useful it was. When someone asks about the real email in six inboxes, you'll answer with a behavior and a time. This week, ask the security team for the report timestamps from your last simulation.

If you've been asked to refresh a phishing awareness module you already have, send it to us for a free diagnostic, and we'll return the three highest-impact improvements to that module within one to two working days.