Technical Anshu
Tutorials Blog
📊 Results and Coaching

Read Phishing Simulation Results Honestly and Coach Repeat Clickers

A results dashboard can make a healthy programme look broken and a broken one look fine - it depends which numbers you read. This page covers the three metrics that matter, the honest limits of the rest, and the conversation that actually changes a repeat clicker.

✍️ Technical Anshu📊 Campaign Results⏱️ Reports up is the win
🎥 Watch the full video - the phishing simulation setup shown step by step

Every platform draws confident-looking charts. Treat them like a senior engineer treats any measurement: ask what the number can and cannot prove before acting on it. Then act on people the way the programme promised - privately, kindly, and with training instead of blame.

Campaign results - one training round (example values)
Clicked the link18% of staff
Reported the email42% of staff
Did neither40% of staff
Repeat clickers from last round3 people - coaching booked
Open ratenot used - unreliable measure
Example values for a mid-size round. Read the second bar first: the reported rate is the behaviour that stops real attacks, and it is the number this programme exists to grow.
1

The three numbers that matter

  1. Clicked rate - who followed the link. Useful, especially split by the lesson the template tested.
  2. Reported rate - who used the report button or told IT. This is the prize: a reported phish warns the whole office within minutes.
  3. Repeat clicks - the small group who clicked last round too. They are not villains; they are your coaching list.

And one popular number to distrust: opens. Modern mail privacy features and security scanners pre-open messages automatically, so open rates measure software, not people. Grade them as noise and never report them upward as fact.

2

Why a click is not a scandal

Click rates move with template difficulty, workload, time of day and how much mail a role receives - a busy accounts inbox is a harder test than a quiet one. That is why the honest comparison is your own last round at similar difficulty, not an industry percentage from a brochure. A higher click rate on a deliberately harder round can be progress in disguise; read the context before reading the verdict.

3

Repeat clickers get coaching, not shame

The conversation is short and private: no blame, a look at the email together, the two checks that would have caught it, and the five-minute module booked there and then. Check the human factors too - mail volume, stress, a phone screen where the sender address hides. Never publish names, never circulate a list, and never let results touch appraisals. The day staff believe clicking means punishment is the day they stop reporting real incidents - the costliest outcome a programme can produce.

4

Report upward in aggregate, always

Leadership gets a one-slide story: totals per round, the reported-rate trend, the coaching completed, the next scenario planned. Department-level percentages at the very most, and small teams merged so nobody can be identified by arithmetic. If a manager asks for names, the approval document answers for you - that refusal was agreed before the campaign existed, which is exactly why it was written down.

🔴 Celebrate reporters louder than you correct clickers. A public thank-you for the team that reported fastest does more for next quarter's numbers than any warning - people repeat the behaviour that gets noticed and praised.

🎥 Watch the Complete Video

See the results view in the video and how the campaign numbers are presented after a send.

▶️ Watch Full Video
❓ Common Questions (FAQ)

What click rate counts as good or bad?

There is no universal score - difficulty, role and mail volume move it too much. Your first round is a baseline; improvement against your own previous rounds, at similar difficulty, is the only honest verdict.

Someone clicked and then reported the email. Pass or fail?

Both numbers record it, and that is fine. The report is the behaviour the programme exists to build, so count it proudly - and the click still earns them the short coaching module. No contradiction.

Should simulation results affect performance reviews?

No - and the approval document should say so explicitly. Linking results to discipline kills incident reporting across the whole company, which is a far bigger security loss than any single click.

This guide is based on the phishing simulation video by Technical Anshu • Stuck on a step? Ask in the video comments - you will get an answer there 🙏