Phishing simulations don't stop attacks directly — they train the people the attacks arrive in front of. That distinction matters, because it decides what a simulation programme can promise and what it can't. Here's what the evidence actually shows, and how to tell whether your programme is working.
What the evidence says
The strongest longitudinal data in the industry comes from KnowBe4's Phishing by Industry Benchmarking Report, which has tested millions of employees for a decade. Its 2025 edition found that, across 2,500+ organisations with over 15.9 million users, the average baseline phish-prone rate — the share of staff who click a simulated phishing email before any training — was 33.1%. After 12 months of sustained training and simulation, that figure fell to 4.1%.
A fall from roughly one in three staff clicking to roughly one in twenty-five is not a marketing abstraction. It is the difference between an attacker having their pick of your staff and having to get past ninety-six people who did not take the bait. The FBI's Internet Crime Complaint Center received 21,442 business email compromise complaints in 2024 with $2.77 billion in reported losses — most of which arrived, at some point, through a message a human being opened.
Simulation programmes also generate reporting behaviour, which is the half of the defence most metrics ignore. Cyber Aware's own programme data shows an average 80% reduction in clicked links over the first eight months of a monthly cadence. A team that reports suspicious emails turns every real attack into an early warning instead of a wait-and-see incident.
What simulations can't fix
Honesty here protects the programme from being oversold internally:
- Simulations test the training, they aren't the training. Sending fake emails without follow-up lessons produces click data and little else.
- A click rate is not a security clearance. People who don't click simulations can still be socially engineered by phone, text or a convincing real invoice that no template predicted.
- One campaign changes almost nothing. Behaviour change comes from cadence — a single annual test measures luck. (We covered the single-campaign question separately in can one phishing simulation campaign change staff behaviour.)
- Simulations don't patch process. If your business wires money on the strength of one email, no amount of click training replaces a verification step.
The four metrics that tell you it's working
If you're running phishing simulations alongside security awareness training, judge the programme on:
- Click rate trend, not click rate level. A 15% click rate falling month over month beats a flat 8%. The 33.1% → 4.1% benchmark arc took twelve months of cadence.
- Report rate. The share of staff who report a simulated phish is the behaviour that catches real attacks. A rising report rate alongside a falling click rate is the healthiest signal a programme can show.
- Remediation follow-through. What happens after a click matters — auto-enrolment into a short follow-up lesson converts each failure into training instead of a disciplinary event.
- Real-incident near-misses. The best evidence simulations work is a documented near-miss: a real fraudulent email that staff reported and nobody acted on. Log them.
Individual-level reporting makes this usable rather than decorative. A human risk score built from training completions, failed quizzes and simulation outcomes shows who needs support — and gives you a trend line to show management at renewal time.
FAQ
Do phishing simulations actually reduce real attacks?
Indirectly, yes. They reduce the share of staff who click malicious email, which is the mechanism most real attacks rely on. The 33.1% to 4.1% phish-prone drop over twelve months is the clearest published evidence of that mechanism working at scale.
Are phishing simulations fair to employees?
They are when handled right: no credential harvesting, no public shaming, and a coaching moment after every click. A simulation that punishes people trains them to hide clicks, not to report.
How long until simulations show results?
Expect a visible click-rate decline within the first quarter of a monthly cadence, and the deep reduction — the 80% range — around month eight.
Can a simulation replace our security awareness training?
No. Simulations measure and reinforce; structured lessons teach. The programmes that move the benchmark numbers run both together.
Should we tell staff that simulations are happening?
Tell them the programme exists — that reporting is welcomed and clicks trigger coaching — but not when the next campaign sends. The habit you're building is reporting, not suspicion of a known schedule.
One last thing
A phishing simulation will never 'stop' an attack the way a firewall blocks a scan. What it stops is the first click — and in business email compromise, the first click is the attack.
Sources
- KnowBe4: 2025 Phishing by Industry Benchmarking Report — baseline phish-prone rate 33.1%, falling to 4.1% after 12 months
- FBI Releases Annual Internet Crime Report — 2024 BEC losses of $2.77 billion across 21,442 complaints
- Proofpoint: Email Attacks Drive Record Cybercrime Losses in 2024 — analysis of the FBI IC3 2024 findings