Two phishing simulation metrics matter: click rate and report rate. Every other number on a simulation dashboard - open rate, time-to-click, campaign difficulty scores - is context at best and vanity at worst. This guide sets the benchmarks for both metrics in 2026, explains why the report rate is the one that predicts real-world incidents, and lists the metrics you can safely ignore.
TL;DR
- Click rate is the headline: about a third of untrained staff click a simulated phish, falling to 4-5% after twelve months of monthly training and simulation.
- Report rate matters more as the programme matures: it should climb past 20% within months, and Cyber Aware's benchmark sees monthly programmes climb past 50% by month eight.
- Cyber Aware's benchmark on monthly programmes: an average 80% reduction in clicked links by month eight.
- Ignore open rates, time-to-click league tables and single-campaign results - one hard lure dips every number at once.
- Track repeat clickers separately: a small group of repeat clickers carries most of the residual risk.
The two metrics that matter
1. Click rate - the risk number
Click rate is the percentage of staff who clicked the link in a simulated phishing email. It measures exposure: of the people who received the lure, how many took the bait.
Industry benchmarks are consistent: roughly 30-40% of untrained staff click a first simulation, and the rate falls to 4-5% after twelve months of monthly training and simulation. The trajectory matters more than any single reading - a team at 8% and falling is healthier than a team at 12% and flat. Cyber Aware's benchmark on monthly programmes is an average 80% reduction in clicked links by month eight.
2. Report rate - the culture number
Report rate is the percentage of staff who used the report button (or forwarded the email) instead of - or better, in addition to not - clicking. It measures the reflex that actually stops real attacks: a reported email gets pulled from every other inbox before the second person opens it.
Report rates climb past 20% within the first few campaigns of a well-run programme, and keep climbing - Cyber Aware sees monthly programmes pass 50% by month eight. A falling click rate with a rising report rate is the signature of a programme that works; a falling click rate with a flat report rate usually means staff have learned to recognise the emails but not to speak up.
Benchmarks at a glance
| Metric | Typical start | Healthy by month 8-12 |
|---|---|---|
| Click rate | 30-40% (untrained) | 4-5% (about 80% lower on monthly programmes) |
| Report rate | Under 5% | 20%+ early, 50%+ by month eight on monthly cadence |
| Repeat clickers | A meaningful share of clicks | Shrinking towards a handful of named coaching cases |
| Overdue training | Varies | Near zero, with a 7-day grace window in place |
How to read the numbers together
- Click rate down, report rate up: working. Keep the cadence and escalate lure difficulty gradually.
- Click rate down, report rate flat: recognition without habit. Celebrate reporters by name after every campaign - the reporting reflex needs more reinforcement than the recognition one.
- Click rate up, report rate up: usually a harder lure, not a failing programme. Read the campaign difficulty before judging the team.
- Both flat: the programme has stalled. Check whether training is actually being assigned monthly, not just simulations.
The metrics you can ignore
- Open rate. Email previews inflate it, and a person who reports without opening did the right thing. It tells you almost nothing.
- Time-to-click. A curiosity, not a KPI. Nobody changes process because someone clicked in 47 seconds.
- Single-campaign results. One well-crafted lure catches anyone; one easy lure flatters everyone. Only the multi-month trend per person is a verdict.
- Campaign leaderboard averages. Averaging across campaigns of different difficulty blends the signal away. Compare like with like, or compare a person against their own history.
Turning metrics into action
Numbers only pay off when they trigger something:
- Auto-enrol clickers into a short lesson on the exact tactic that caught them, the same week - Cyber Aware's phishing simulations do this by default.
- Coach repeat clickers individually. Escalating, targeted training resolves the majority of repeat clickers within a quarter; treat it as coaching, never discipline.
- Roll everything into one number per person. Cyber Aware's human risk reporting combines clicks, reports, quiz results and overdue courses into a monthly score, so a manager reads one trend line instead of four spreadsheets.
- Report upward on the trend. A board slide showing click rate 33% to 5% and report rate 4% to 50% across eight months is the whole business case for the programme - and the training cadence behind it.
FAQ
What is a good phishing click rate? Below 5% after a year of monthly programmes is the benchmark. In the first months, anything under 20% is already better than most untrained baselines of 30-40%.
What is a good phishing report rate? Above 20% within the first few campaigns, and 50%+ by month eight on monthly programmes. The trend matters more than the level.
Should I benchmark my team against other companies? Lightly. Lure difficulty and workforce mix differ too much for league tables. Compare your team against their own last three months.
Do failed simulations predict real incidents? They predict risk, not incidents - and that is the point. Repeat clickers and overdue learners are the people a real attack reaches first, which is why they get targeted coaching.
One last thing
If your dashboard shows more than two numbers at the top, ask what decision the third one drives. Click rate says where the risk is; report rate says whether the culture is forming. Everything else is decoration.