Phishing Simulation Metrics: What to Track Besides Clicks
Try Skillermatic free Start a free trial and look at the lessons, the admin portal and phishing simulation yourself. Start a free trial → The phishing simulation metrics that matter are click rate, submit rate, report rate, time to report and repeat clickers. Report rate is the one to watch most.
A low click rate feels good. But if nobody reports, you do not know if people spotted the email or just ignored it. Real emails go unreported too. Here are the numbers that tell the real story.
What phishing simulation metrics should you track?
Track these five. Together they show who clicked, who would have given something away, and who spoke up.
| Metric | What it tells you |
|---|---|
| Click rate | Who would have followed the link |
| Submit rate | Who would have given away a password or detail |
| Report rate | Who spotted it and told you |
| Time to report | How fast you would hear about a real attack |
| Repeat clickers | Who needs extra help |
CISA suggests evaluating training by watching security incidents and reporting during phishing simulations. That is the report rate, and it is the one to watch.
What is a good phishing click rate?
There is no magic number. A hard scenario will get more clicks than an easy one, so a single number means little on its own. The best test is whether your own numbers improve from one campaign to the next.
If you must set a goal, make it about direction: click rate down, report rate up, over several campaigns.
Why is report rate the best phishing metric?
Because a report is the behaviour you want in a real attack. Someone who reports a suspicious email lets you warn everyone else, block the sender and check who else got it.
A click rate on its own can fool you. People who ignore every odd email look “safe,” but they also will not tell you about a real one. Teach staff where to report, and thank the ones who do.
How do you read the results?
Look at the pairs of numbers, not one number at a time.
- Click rate up, report rate up: People are active. Good sign, if clicks fall next time.
- Click rate down, report rate flat: People may be ignoring everything. Add a lesson on reporting.
- Click rate flat everywhere: The lessons are not landing. Make them shorter and more real.
- One department is high: Give that team a lesson built for their job.
A worked example
Say you run two campaigns on a 40-person team. These numbers are made up for the example, to show how to read them.
| Campaign 1 | Campaign 2 | |
|---|---|---|
| Click rate | 30% (12 people) | 20% (8 people) |
| Report rate | 10% (4 people) | 25% (10 people) |
Fewer people clicked and more people reported. That is a good trend. Next, look at which team the 8 clickers sit in, and give that team a lesson built for their work.
What are the rules for fair numbers?
- Compare campaign to campaign inside your company.
- Do not compare a hard scenario to an easy one.
- Break results out by department.
- Look at at least three campaigns before you decide on a trend.
- Never publish a “shame list.”
What does Skillermatic report?
From our phishing simulation page: open, click, submit and report tracking for each campaign, an executive PDF report, a monthly summary email, and automatic remediation lessons for people who clicked or submitted. Reports can be broken out by department on the platform.
What should a one-page leadership update include?
Four things, on one page. That is all most leaders want to read.
- This quarter’s report rate and click rate, with last quarter beside it.
- The riskiest group, and why.
- The next scenario and the next lesson.
- One sentence on what you need.
What is a simple template to record each campaign?
Keep one row per campaign in a sheet. It makes the trend easy to see after three runs.
| Date | Scenario | People | Click rate | Submit rate | Report rate | Repeat clickers | Next step |
|---|---|---|---|---|---|---|---|
Add one short note under each row about what you will change. For example, “Add a lesson on fake invoices for finance.” The note is what turns numbers into action.
Next
If you are new to simulations, start with phishing simulation for small business. To connect the numbers to lessons, read security awareness training vs phishing simulation. For record keeping, see how to track employee training completion.
To see a sample report, book a demo or start a free trial.
Questions people ask
What is a good phishing click rate?
There is no single right number, and scenarios differ in difficulty. Compare your own results over time and by department.
What is a phishing report rate?
The share of people who reported the practice email instead of ignoring it or clicking. A rising report rate means people are spotting and telling you about suspicious messages.
Why does the report rate matter more than the click rate?
A low click rate can just mean people ignored the email. A high report rate shows they noticed it and told you, which is what you need during a real attack. CISA advises tracking reporting during phishing simulations.
What is a submit rate?
The share of people who typed something into the fake form. It shows who would have given away a password.
How many campaigns do I need before I see a trend?
Look at at least three campaigns before you decide. One run can be too easy, too hard or sent in a busy week.
What should I send to leadership?
One page: the trend in report rate and click rate, the biggest risk group, and what you will do next. Skillermatic makes an executive PDF after each campaign.