A failed phishing simulation is a remediation queue, not a public-shaming exercise. If your latest 2026 simulation shows a 23% click rate, that 23% is a named list of people who need a specific course, an IT hardening pass and a manager conversation — in that order. This guide gives the same-day, week-one and month-one checklists that turn a click rate into a fixed program.
TL;DR
- Treat every simulation failure as a queue of named people with specific next actions — never as a company-wide shame report.
- Same day: force password resets for anyone who submitted credentials, auto-enrol clickers in a failed-phishing course, log events against each learner's Human Risk Score.
- Week one: deliver the targeted micro-course (invoice fraud, fake login pages), check MFA on every account that clicked.
- Month one: manager conversations for repeat clickers, retire any template that clicks above 40%.
- Judge the program on report rate rising and repeat-failure rate falling across 2026, not on one month's click number.
What a failed phishing test actually means
A click on a simulated phish is a training signal, not a disciplinary event. In 2026 the same click carries two very different severities: a click with no credential entry is roughly a 2-minute course fix, while a credential entry is an account-security incident that needs MFA verification and a password reset before any training happens. Staff who clicked or submitted credentials should land in a failed-phishing course the same day, while the email is still fresh in their memory.
Why the same staff keep failing the same tests
Three reasons repeat failure happens. First, the wrong course: a generic annual module does not change how a person reacts to a realistic invoice-fraud email. Second, no automation: remediation depends on an admin exporting a clicker list and building a manual follow-up email, and the moment that person is on leave the program silently stops. Third, template reuse: staff learn to recognise the exact simulated emails your program keeps sending, pass every test, and your company's real-world phish profile stays untested.
The same-day checklist: first 24 hours
Run these in order. Each step exists because skipping it breaks something downstream.
- Freeze what the click may have exposed. If the simulation asked for credentials, treat it like a real incident: revoke active sessions, force a password reset for every account that submitted credentials, and confirm MFA is enrolled on each. If the email only asked for a click, skip the reset sweep — the risk is behaviour, not access.
- Auto-enrol clickers into a failed-phishing course scheduled for the same day. A click is a training gap, and the course lands while the email is memorable.
- Log every event against the learner's Human Risk Score so overdue courses, quiz failures and phishing clicks feed one number per person. Platform-tracked events beat manual spreadsheets, because the score updates itself — see how human risk reporting rolls this up per learner.
- Do not publish a leaderboard or a who-clicked email. Public shaming cuts reporting rates: staff stop reporting real phishes because a report that gets them named on a list costs them reputation. Publish aggregate numbers only.
- Note the exact template, send time and click timestamps — you will need them for the template-retirement decision in month one.
The week-one checklist: days 2-7
Week one converts the incident into a permanent fix.
- Deliver the failed-phishing course to the clicker cohort and record completion. A clicker who finishes a short course within a week of the click is far less likely to click the next one.
- Send credential-entry staff the matching micro-course: invoice fraud for finance-flavoured phishes, fake login pages for credential-harvesting templates.
- Check MFA coverage on every account that clicked. A clicker without MFA is the single highest-risk person on the list — the training helps, but the account protection matters more.
- Send a short thank-you to reporters. Staff who reported the simulation get a two-line acknowledgment. This is the behaviour you want repeated, and it is free.
- Update the next simulation's difficulty. If 23% clicked, the next template should be a notch harder, not a repeat of the same lure.
The month-one checklist: fixing the program, not just the person
By week four the individual fixes are done; the program-level decisions remain.
- Manager conversations for repeat clickers. A second click within 90 days is a manager conversation, not another identical course. Keep it supportive and specific: what email, what moment, what the correct action was.
- Retire templates that clicked above 40%. A template that consistently clicks above 40% is either too realistic for your environment or testing something you cannot remediate — either way it stops being useful data.
- Review timing. A template sent at 4:55 pm on a Friday clicks differently from the same template at 9:30 am Tuesday. Vary send times across 2026 so the data reflects people, not the clock.
- Compare report rate and click rate on the same chart. A program is working when report rate climbs and repeat-failure rate falls, month over month — the click rate alone will mislead you because template difficulty changes.
What good looks like at the end of 2026
A mature program ends 2026 with three measurable properties. Report rate is trending up month over month — reporting is the metric that survives a real attack. Repeat-failure rate is low: fewer than one in ten learners clicks twice in a quarter. And no learner ever appears on a public list: remediation is private, targeted and automatic. If you are rebuilding the cadence from scratch, start with phishing simulation fundamentals rather than patching templates one by one.
| Milestone | Owner | Deadline |
|---|---|---|
| Password resets for credential entry | IT | Same day |
| Failed-phishing course assigned | Platform (automatic) | Same day |
| Micro-course completion | Platform (tracked) | Week 1 |
| MFA check on clicker accounts | IT | Week 1 |
| Manager conversations | Line manager | Month 1 |
| Template retirement review | Program owner | Month 1 |
FAQ
Should employees be named publicly when they fail a phishing simulation? No. Public naming cuts reporting rates and pushes real phishes underground. Remediation is private and targeted; company-wide reporting shows aggregate percentages only.
How quickly should a failed-phishing course be assigned? Same day. The course lands while the simulated email is still fresh, which is when the behaviour fix is most likely to stick.
What is the first action after someone enters credentials in a simulation? Treat it as a real incident: revoke sessions, force a password reset and verify MFA before any training assignment. Training follows account security, never replaces it.
How do you stop the same staff failing the same tests? Diagnose in order: wrong course, no automated remediation, or template reuse. Fix the course match first, automate the enrolment second, and rotate templates third.
What click rate is acceptable in 2026? There is no universal threshold — template difficulty varies too much between campaigns. Trend is what matters: click rate falling and report rate rising month over month.
When does a manager get involved? On a second failure within 90 days. Keep the conversation supportive and specific to the email, not disciplinary.
One last thing
The single highest-leverage change most programs can make in 2026 costs nothing: stop chasing the click rate and start tracking report rate. A workforce that reports suspicious email, even when it clicks, is the workforce that survives a real attack — because reporting gives your team minutes, not days.