Large‑Scale Study Shows Click Metrics Miss Key Phishing Risks, Prompting Rethink of Awareness Programs

New research is prompting a reassessment of how companies evaluate their employees' ability to spot phishing attacks. An analysis of 2.47 million simulated phishing attempts demonstrates that measuring only the number of users who click a malicious link provides an incomplete view of organizational risk.

Most security‑awareness initiatives rely on click‑through rates as the primary success indicator. While easy to record, this metric overlooks two outcomes that are more directly linked to actual breaches: the submission of credentials to a fake login page and the act of reporting the suspicious email to the security team.

The study observed that credential‑submission events, though far rarer than simple clicks, are far more predictive of real‑world compromise. Organizations that focus exclusively on click counts may fail to detect users who unwittingly provide login details, a behavior that attackers can leverage for sustained access.

Equally important, the research highlighted reporting rates as a strong signal of a resilient security culture. Employees who quickly flag phishing attempts enable security teams to contain threats and refine future training. By tracking both credential leaks and reporting alongside clicks, companies can obtain a more nuanced picture of their phishing defenses.

Security professionals say the findings could reshape awareness program design. Vendors are likely to enhance simulation tools so they can capture credential entry and automatically log user reports, shifting training emphasis from merely avoiding clicks to encouraging detection and safe reporting. Over time, these richer metrics may help organizations build more realistic defenses against increasingly sophisticated phishing campaigns.