Yes. In Cyber Aware, every learner gets a personal dashboard that shows their own phishing simulation history — which campaigns they clicked, which they reported, and their own Human Risk Score — while organisation-wide results stay on the admin side only. Learners never see anyone else's score, clicks or reports, and the simulations themselves never capture passwords, so what a learner sees is about behaviour, not credentials.
TL;DR
- Yes — each learner has a private dashboard showing their own phishing history: simulations they clicked, simulations they reported, and their own Human Risk Score.
- The view is deliberately narrow. Admins get the full reporting suite — who clicked, who reported, how numbers trend; learners see their own numbers and nothing else.
- The most useful results arrive before the dashboard: a click triggers a branded explainer and auto-enrolment into a follow-up course, and a clean report triggers a congrats email that shows the simulated phish.
- Simulations run without credential harvesting, so results measure behaviour only — who clicked, who reported, nothing sensitive.
Can staff see their own phishing simulation results?
In Cyber Aware, yes — that is built into how the learner side of the platform works. The phishing simulations feed two views: the admin reporting page, which shows who clicked, who reported and how the numbers trend over time, and the learner dashboard, which shows each person only their own history.
The learner dashboard is the human risk reporting learner view: it carries their personal Human Risk Score, their course stats and their phishing history. A learner who clicked last month's Xero invoice simulation, for example, sees that click on their dashboard — and they also see the follow-up course it triggered. A learner who reported that same simulation sees the report logged there instead.
That split matters. A staff member who can see their own record can connect a click to the coaching that followed it. A staff member who can see the whole team's failures would connect a click to embarrassment — which is exactly the feeling that stops people reporting suspicious emails.
What a learner actually sees
Three things land on a learner's personal dashboard:
- Their own Human Risk Score. One number per learner per month, built from overdue courses, failed quiz attempts and phishing results, with 0–3 flagged as low risk, 3–6 moderate and 6+ high. It resets to zero on the first of each month, with a 7-day grace period on every due date.
- Their training record. Completed courses, on-time percentage and quiz pass rate, plus the list of assigned courses still open.
- Their phishing history. Each simulation they were sent, marked reported or clicked, with the campaign name and the month — for example, a reported Xero invoice simulation in July, or a click in June with the auto-enrolled follow-up next to it.
Everything on that page is about one person. There is no company-wide click rate, no ranking of colleagues and no exportable admin view.
What learners never see
The admin side of the platform is a different surface. On a security awareness training programme, admins get the full reporting suite — six dashboards including human risk scores for every learner, course summaries, engagement, leaderboards and compliance filters for audit questions. Learners get none of that:
- They cannot see other learners' Human Risk Scores.
- They cannot see who else clicked a campaign or who else reported it.
- They cannot see the campaign-level result tables admins work from.
The only scoreboard visible to a learner is their own history. That keeps the data personal and keeps the conversation between the learner and the people whose job is to help them.
The first results arrive before the dashboard
The dashboard is the long-term record, but the immediate result of a simulation is a message in the learner's inbox, and it differs by outcome:
- Clicked a simulation? They land on a branded explainer — the exact phishing email that was sent, the red flags in it and what to look for next time — and they are auto-enrolled into the failed-phishing course without anyone having to send an awkward follow-up email.
- Didn't click? They get a congratulations email that reveals the phishing email that was sent, so a pass becomes its own lesson.
- Reported it? The report is logged and surfaced to admins, and reporting is treated as the win it is.
Every outcome becomes a learning moment rather than a mark against the person. That design — fail, explain, retry — is why the click rate on a well-run programme falls rather than flattens.
Why the privacy split matters
The case for keeping results personal is the same case that makes phishing simulations worth running in the first place. Verizon's 2025 Data Breach Investigations Report analysed 22,052 incidents and 12,195 confirmed breaches and found a human element in roughly 60% of them (full report PDF). The human layer only improves if people engage with it, and people engage with coaching, not with a public list of who got caught.
There is a practical side too. Cyber Aware's simulations run without credential harvesting — there is no fake password page collecting real logins. Reporting shows who clicked and who reported, which is everything a programme needs, and it means the learner's own results contain nothing that would be dangerous if they saw them.
Reporting a suspicious email: the result staff should chase
The dashboard records two kinds of phishing result — clicked and reported — and the second one is the one to celebrate. A report button in the portal plus Outlook and Gmail add-ins let staff flag anything suspicious in one click. Every report is logged, and reported emails are matched against the simulation schedule, so a learner can see that the email they reported last month was in fact the simulation.
That closed loop is what turns the dashboard into a habit: simulate, respond, see the outcome, repeat next month. Staff who report quickly protect the whole mailbox list, because a report on a real phish can be pulled from other inboxes before a second person clicks.
FAQ
Can staff view their own phishing simulation results? Yes. Each learner's dashboard shows their own phishing history — simulations they clicked and ones they reported, with the campaign and month — alongside their own Human Risk Score and training record.
Do learners see how their colleagues performed? No. Learners see only their own score and history. The full reporting suite — everyone's results, trends and filters — is the admin view.
Can staff see the actual phishing email that was sent? Yes. A click opens a branded explainer showing the simulated email and its red flags, and people who didn't click get a congrats email that reveals the same email, so every outcome teaches something.
Do the simulations collect passwords? No. Cyber Aware's phishing simulations run without credential harvesting. Results show who clicked and who reported, and nothing sensitive is captured.
What happens to a learner who clicked a simulation? They see a branded explainer immediately and are auto-enrolled into the failed-phishing course. The click also feeds their Human Risk Score, which is why it appears on their own dashboard.
Can staff report emails from inside Outlook or Gmail? Yes — a report button in the portal plus Outlook and Gmail add-ins. Every report is logged, matched against simulations and surfaced in the learner's own history.
One last thing
If your team has never seen their own phishing history, run one campaign and ask them to open their dashboard afterwards. The first look usually does more for reporting culture than any memo — people learn that a click here is a lesson, not a disciplinary record.