← All Blogs

Report rate, not click rate, is the phishing simulation number that matters

By Best IT MSP Editorial Team - Updated October 20, 2026 - 9 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

Why does report rate matter more than click rate?

Report rate matters more than click rate because a reported message starts an investigation and a clean click rate starts nothing. Report rate is the share of recipients who actively flagged a suspicious message, usually by pressing a report button in their mail client.

Click rate counts who touched the link. Report rate counts who noticed and told you. Those two figures are not two views of the same behaviour, and only one of them feeds incident response. An employee who smelled a fake invoice, deleted it, and said nothing scores perfectly on click rate while leaving you blind.

The limits of the older metric are now official. CISA, the NSA, the FBI and MS-ISAC published joint phishing guidance in 2023, and CISA's associate director for vulnerability management put it bluntly: for too long, the prevailing guidance to prevent phishing attacks has been for users to avoid clicking on malicious emails, and we know that this advice is not sufficient. A metric built on that advice inherits its limits.

This guide is about the report your provider sends you, not about the attacks themselves. For the attack types, read Phishing vs Spear Phishing vs Whaling Explained. For the controls, read Email Security Best Practices. Here you get the three numbers to ask for instead, and how to tell a weak report from a useful one.

How can a falling click rate mean you are less safe?

A falling click rate means less safety in two specific cases. Staff recognised the simulation rather than the threat, or they recognised the threat and told nobody. Both produce a better-looking number and a worse-prepared business.

Staff learn the simulation vendor, not phishing

Vendors simulate attacks on a schedule, from a narrow set of sending domains, with tracking links of a recognisable shape. People are good at pattern matching, so after a few rounds they learn the pattern that affects them, which is the test. The NCSC makes the underlying point plainly: users frequently need to click on links from unfamiliar domains to do their job, and being able to spot a phish is not their job. A number that rewards suspicion of one sender's house style does not measure judgement about real mail.

Single-campaign click rates also flatter you by design. Across 15 months at a partner company, ETH Zurich researchers recorded clicks on 6,680 of 117,864 simulated phishing emails, a click rate of 5.67 percent. Over the same period, 32.10 percent of the 14,733 participants clicked at least one. A 5 percent monthly figure and a one-in-three population exposure are both true. Only the second tells you how many people an attacker reaches if he keeps trying.

Silent suspicion scores a perfect click rate

The second failure is quieter and worse. An employee who suspects a message and says nothing has protected only himself. Nobody pulls the message from other inboxes, nobody blocks the sender, and nobody starts the clock on incident response. The NCSC describes the mechanism exactly: the stigma of clicking can prevent people reporting it, which then delays the incident response. Click rate cannot see that behaviour at all. Report rate is the only metric that does.

What does the research on phishing simulation and security awareness training show?

The research shows that phishing simulation and security awareness training move click rate very little, and that staff reporting works well. Two large field studies, both peer reviewed, point the same way.

Researchers at UC San Diego ran a randomised experiment across ten simulated campaigns sent to 19,500 employees over eight months at UC San Diego Health, published as a full paper at the IEEE Symposium on Security and Privacy in 2025. Embedded training, meaning the page a user lands on straight after clicking, reduced the likelihood of clicking a phishing link by 2 percent. The same team found no significant relationship between recently completing annual mandated training and the likelihood of falling for phishing emails.

The engagement data explains why. Three quarters of users spent a minute or less on the embedded material, and a third closed the page without engaging at all. That is training fatigue, and it never appears in a completion report. Completion percentages and policy acknowledgement records are administrative facts. They prove a box was ticked, not that anyone can detect a fake invoice.

The ETH Zurich study is larger and ran longer. It found that voluntary embedded training does not make employees more resilient to phishing and can carry side effects that leave them more susceptible. The same study reached the opposite conclusion about reporting, finding that using the employees as a collective phishing detection mechanism is practical in large organizations, with fast detection of new campaigns and sustained participation over time.

What is time to report, and why does it beat click rate?

Time to report is the gap between a phishing message landing and the first person telling your security team about it. It beats click rate because the only thing that shortens a real incident is somebody telling you, and time to report is the number that measures exactly that.

The ETH Zurich deployment makes the arithmetic concrete. Around 10 percent of the reports arrived within 5 minutes of delivery, with roughly 20 percent inside 15 minutes. Modelling a 1,000-employee firm with 100 staff targeted, the researchers estimated you would receive between 8 and 25 reports of the email, with one arriving within 5 minutes with high probability. Five minutes is faster than most help desks notice anything.

Early reports are worth money, not just reassurance. IBM put the global average breach cost at 4.99 million dollars in 2026, a 12 percent increase over last year and a record high, and found that detection and escalation plus lost business make up 63 percent of breach costs. Those are the two components a fast report compresses. Nothing in a click-rate chart touches either of them.

Report rate without time to report is half a number. A 30 percent report rate where the first report lands the next morning is weaker than a 12 percent report rate where somebody escalates within four minutes.

Does punishing people who click reduce your risk?

No. Punishing people who click reduces your report rate, and a lower report rate raises your risk. The UK's National Cyber Security Centre says so in its published guidance rather than leaving it to interpretation.

The NCSC tells organisations to avoid creating a punishment or blame-oriented culture around phishing, to not reprimand users who are struggling to recognise phishing emails, and that training should reassure users that they will not get in trouble if they report phishing incidents. It also sets the bar for the process itself, advising organisations to have an effective process for users to report phishing and to quickly provide feedback on what action has been taken, and make it clear that their contributions make a difference.

Naming the people who clicked, auto-enrolling them in remedial modules, or copying their manager all buy a lower click rate next quarter. They buy it by teaching staff that silence is the safe move.

Will a blameless report button flood your help desk?

No, and the ETH Zurich deployment measured the load instead of guessing it. The average accuracy of reports was good, at 68 percent, rising to 79 percent when spam counts as a correct report, and across the whole system only 689, or 9 percent, of the triage decisions were taken by human administrators. Participation also held up rather than collapsing, with 90 percent of the employees who reported suspicious emails reporting six or fewer across 15 months and no significant reporting fatigue. Reporting volume is manageable. The blind spot it removes is not.

The attacks click rate cannot measure at all

Click rate measures nothing for several of the most expensive attacks, because four of them carry no link to click.

• Business email compromise and invoice fraud. The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints and more than 3 billion dollars in reported losses in 2025. A payment-redirect email carries no attachment and no malicious link.
• Pretexting. An attacker builds a believable story first, often across several polite messages, then asks. There is nothing to click until the final step, and sometimes nothing at all.
• Deepfake voice. The FBI warned that malicious actors are more frequently exploiting AI-generated audio to impersonate well-known, public figures and advised recipients to independently identify a phone number for the person and call to verify their authenticity. IBM recorded AI-driven attacks increasing 56 percent, led by AI deepfake impersonations.
• MFA fatigue. An attacker holding a stolen password spams approval prompts until one is accepted. CISA recommends number matching to mitigate MFA fatigue where phishing-resistant MFA is not yet in place, while noting that number matching is not as strong as phishing-resistant MFA.

Technical controls help and they do not close this gap. A lookalike display name passes email authentication because the attacker's own domain is perfectly authentic, a point we set out in Your DMARC record says p=none and will not re-argue here. The consequence for your report is simple. A test set made only of links and attachments produces a number that describes a shrinking part of your exposure. Verizon's 2026 report already measures click rates roughly 40 percent higher on mobile devices than on traditional email, where the sender line is truncated and the link preview is gone.

The three numbers to ask your provider for

Ask your provider for three numbers at your next review, in place of the click-rate headline. Each is a single figure, each is measurable from the system they already run, and a provider operating a real programme can produce all three in a day.

• Request the report rate per campaign, split by department, printed next to the click rate.
• Compare the median time to report across the last four campaigns, measured from delivery to the first report.
• Count the self-report rate among clickers, meaning the share of people who clicked and then reported it anyway.

The third number is the one almost nobody tracks and the one that tells you most. A clicker who reports within minutes gives your provider a chance to contain the account before anything moves. A clicker who hides is the opening of a long and costly incident. Read all three together, because a click rate falling while report rate stays flat is a warning sign rather than progress. It usually means people are learning the test.

What a good report looks like

Good looks like a specific report rate quoted per department, a median time to report stated in minutes, a named person who triages every report, feedback sent back to the reporter, and a quarterly trend instead of a single month. Vendors now sell this bundle as human risk management, which is a fair label. The question is which numbers it reports. Ask what the report button is, where it sits in the mail client, whether staff can use it on real mail as well as simulated mail, and who escalates a report at 9pm on a Friday.

Five answers mark a weak programme.

• Click rate presented alone, with no report rate anywhere in the document.
• No median time to report, because nobody records the timestamps.
• Clickers named, emailed, or copied to their line managers.
• Completion percentages and policy acknowledgement counts offered as risk reduction.
• A report button that only works on simulated mail.

What to change before your next provider review

Change three things before your next review. Move the headline metric from click rate to report rate, add a median time to report, and strip every consequence attached to clicking. None of this needs a new tool, none of it costs a licence, and none of it buys perfect protection.

A provider who can tell you how many minutes passed before the first employee reported a campaign is running a programme. A provider who can only tell you the click rate is running a test.

Then train your staff on the single behaviour that pays. Tell them you would rather field fifty false alarms than miss one real report, and mean it when the fifty arrive. The evidence is unusually consistent on which half of the equation earns its place: employee reporting delivered fast detection of new campaigns at an acceptable operational load, while embedded training delivered a 2 percent change in the likelihood of clicking. One of those is worth building a metric around, and an independent review of your provider's reporting is a cheaper place to start than a new platform.

FAQ

What is a good phishing simulation report rate?

No published benchmark defines a good report rate, so compare yours against your own trend and against your click rate. In the ETH Zurich study, 4,260 of 14,733 participants reported at least one suspicious email across 15 months. Track it per department and watch the direction rather than chasing one target figure.

Why is click rate a weak phishing simulation metric?

Click rate falls when staff learn to recognise the simulation vendor rather than phishing, and it stays clean when someone suspects a message and says nothing. A UC San Diego experiment found embedded training reduced the likelihood of clicking by 2 percent, so a falling click rate rarely reflects new skill.

Should employees be punished for clicking a phishing test?

No. The NCSC advises organisations to avoid creating a punishment or blame-oriented culture around phishing and that training should reassure users that they will not get in trouble if they report phishing incidents. Punishment lowers report rate, and the stigma of clicking can prevent people reporting it, which then delays the incident response.

How fast should staff report a phishing email?

Within minutes. In the ETH Zurich deployment, around 10 percent of reports arrived within 5 minutes of delivery, and a 100-person campaign would produce between 8 and 25 reports, with one inside 5 minutes with high probability. Ask your provider for the median time to report, measured from delivery.

Does security awareness training reduce phishing risk?

Only slightly, on current evidence. UC San Diego researchers found no significant relationship between recently completing annual mandated training and falling for phishing, and that three quarters of users spent a minute or less on the training material. Reporting behaviour is the more reliable thing to measure, reward and report on.

← All Blogs