Someone in your team just clicked a simulated phishing email. The dashboard says they failed — but the test has already done its job. A phishing simulation that nobody clicks tells you nothing about your defences; a click, handled well, is the cheapest security lesson your organisation will ever buy. This guide walks through exactly what to do in the hours and weeks after a failed test, what never to do, and how to turn a pattern of clicks into a targeted coaching plan instead of a blame exercise.
TL;DR
- Treat a failed test as a coaching trigger, not a disciplinary event. Punishing clicks is the fastest way to stop people reporting real phishing — and an unreported real attack is the worst possible outcome.
- Auto-enrol the clicker into a short module on the exact tactic that caught them. Same week, five to ten minutes, not next quarter's annual refresher.
- Have a short, blame-free conversation. Most clicks happen to busy, competent people on a bad day; the fix is habit, not willpower.
- Watch for repeat clickers. One click is noise, two is worth a closer look, three in a row is a pattern that needs role-specific content and a manager's involvement.
- Log every result. Six months of click, report and completion data is the evidence trail auditors, insurers and enterprise clients increasingly ask for.
The first 24 hours: record it, then coach it
The moment a click registers, two clocks start. The first is the remediation clock — how fast the person gets targeted training. The second is the cultural clock: everyone in the office is watching how you treat the person who clicked, and they will calibrate their own future honesty accordingly.
In the first day, do three things:
- Confirm the click was simulated. It sounds obvious, but mixed signals happen — a real suspicious email and a simulated one can land the same week. Check the campaign log before anything else.
- Enrol the remediation. The training that follows a click should address the tactic that worked — credential harvesting, a fake invoice, an MFA approval prompt — not a generic annual module. Cyber Aware's phishing simulations do this enrolment automatically the moment a click is logged.
- Resist the group email. Announcing that someone clicked to the whole company shames one person while teaching nobody. If you want to use the example, strip the identity and share the tactic: 'a fake DocuSign landed this week; here is how to spot the next one.'
The 24-hour window matters because attention decays fast. A click followed by a five-minute course the next morning connects the mistake to the lesson while the email is still in the person's memory. The same course delivered six weeks later is a formality.
The conversation: five minutes, blame-free
If you manage the person, the conversation is where the behaviour actually changes. Keep it to five minutes and get three things across:
- The click was safe and expected. Simulations exist so mistakes happen on fake emails, not real ones. Say that explicitly.
- What the email had that a real one would too. Walk through the tell together — the lookalike domain, the urgency, the unexpected attachment. The person should leave able to name the tell themselves.
- What to do next time. Not 'be more careful' — the concrete action: hit the report button, or forward it to IT, or just say 'I'm checking with you before I open this.'
One warning: never record the conversation as a performance issue or add it to a formal warning process. The moment employees believe a simulated click could end up in their HR file, reporting of real phishing collapses — and unreported real phishing is the outcome the entire programme exists to prevent.
Remediation training: same week, same tactic
The remediation module is not the annual course again. It is a short, specific lesson on the tactic that caught the person:
| Tactic that caught them | What the remediation covers |
|---|---|
| Credential harvesting | Spotting lookalike login pages, checking the real domain, why password managers refuse to autofill on fake sites |
| Fake invoice or payment change | Verifying bank detail changes by phone using a number you already had — never one from the email |
| MFA approval prompt | Why an unexpected approval prompt means someone already has your password, and what to do immediately |
| Document-sharing lure | How attackers spoof SharePoint and Google Drive previews, and the hover-check habit |
| Payroll or HR update | Why HR changes never arrive as an open-this-link email in your organisation |
Ten minutes on the exact miss beats forty-five minutes of generic content, and it respects the person's time — which matters if you want the training finished rather than merely assigned. Completion of the remediation module should be tracked alongside the click itself; security awareness training that runs on short monthly modules keeps both the volume and the follow-up manageable.
When one click becomes a pattern
Most people click once, take the lesson, and never appear in the click column again. The group that needs a different response is the small tail of repeat clickers — in most organisations a handful of people who account for a disproportionate share of the total click risk.
- Two clicks: nothing public. Two targeted remediations, and a note to check whether the person's role exposes them to unusually convincing lures — finance staff see better forgeries than almost anyone.
- Three clicks: a manager conversation about role fit for high-risk inboxes, plus a longer coaching sequence on the tactics that keep catching them. At this point the question is whether the person's actual job duties need adjusting (for example, taking them off payment approvals) rather than whether they need another video.
- Everyone else: stay out of the way. The programme works when the majority click rarely, report often, and hear about it only when they do something right.
The tail is also where the data earns its keep. If repeat clickers cluster in one team, the problem may be the team's inbox exposure — shared mailboxes, customer-facing addresses, payment workflows — and the fix is structural, not another module.
What never to do after a failed test
A few responses feel satisfying in the moment and quietly destroy the programme:
- Never name and shame. Leaderboards of clickers, public call-outs, or a worst-performers slide guarantee the numbers stop telling the truth — people learn to report nothing.
- Never tie the click to pay, performance reviews or probation. Beyond being corrosive to culture, it invites employment-law questions you do not want. Coaching is the defensible and effective path.
- Never make the simulation a trap. Ultra-realistic deceptions used to catch staff out teach people that security is an adversary, not an ally.
- Never skip the follow-up because the person is senior. An executive who clicks and receives no remediation teaches the whole company that the rules are decorative.
Where the evidence goes
Every click, report, remediation and completion should land in one place, because the trend line is what you will eventually be asked for. Insurers underwrite cyber policies on it, auditors under Essential 8 and ISO 27001 expect evidence of ongoing human-layer testing and remediation, and enterprise clients increasingly ask about it in security questionnaires. Human risk reporting turns the raw events into a per-person and per-team trend — click rate, report rate, training completion — so a failed test becomes one data point in a six-month improvement curve rather than an anecdote.
And the more important number sits next to the click rate: report rate. An employee who clicks a simulation and then reports it is displaying exactly the behaviour that stops a real incident. Celebrate that.
FAQ
Should the employee's manager be told who clicked?
Yes — the manager runs the coaching conversation, so they need the name. Wider than that, no: department-level trends, not individual lists.
What if the person reports the simulation instead of clicking it?
That is a pass, and worth a public thank-you. A report on a simulated email is a rehearsal of the exact behaviour that stops real attacks.
How soon after a click should the training arrive?
Within the same working week. Same-day is ideal; the connection between the mistake and the lesson weakens noticeably after that.
Do failed tests need to be reported to anyone outside the company?
No. A simulated click is an internal measurement, not an incident. It becomes reportable only in the sense of internal audit evidence under frameworks like Essential 8.
What click rate should trigger a programme review rather than individual coaching?
When a whole campaign's click rate jumps — especially after a new template family — the problem is the tactic's novelty, not twenty individual failures. Re-teach the tactic company-wide and keep individual follow-up for the repeat clickers.