# The Phishing Metric That's Been Lying to Your CISO for a Decade
Security awareness programs have a dirty secret: the number everyone reports to the board doesn't measure what actually gets organizations compromised.
For years, the click-through rate has been the headline metric for phishing simulations — the percentage of employees who clicked a simulated malicious link. It's clean. It's reportable. It fits in a quarterly slide. And according to a new analysis of 2.47 million simulated phishing attacks, it may be leading organizations to optimize for the wrong outcome entirely.
The research, which represents one of the largest empirical datasets ever assembled on simulated phishing behavior, makes the case that security teams should be tracking credential submission rates and employee reporting rates instead. Those two signals, the authors argue, are the ones that actually correlate with real organizational risk.
## Clicks Don't Kill Organizations. Passwords Do.
Think about what a click actually means. An employee receives a simulated phishing email, clicks the link, lands on a fake login page — and then hesitates. Maybe they notice the URL looks odd. Maybe muscle memory kicks in and they close the tab. That employee clicked. They appear in your click-rate metric. But they never handed over credentials.
Now consider the employee who clicks, sees a convincing Microsoft 365 login page, and types their username and password without a second thought. Same initial click, radically different outcome.
The difference between these two employees is the difference between a near-miss and a breach. Yet most organizations treat them identically in their reporting.
Credential submission rates expose this gap. An organization might have a 12% click rate — comfortably within the industry average range that consultants like to cite — while simultaneously having a 9% credential submission rate. That's nearly three-quarters of clickers actively surrendering their passwords. If that were happening on a real campaign, you'd be dealing with a mass credential harvesting event before lunch.
The research doesn't just flag this metric; it quantifies the gap at scale across those 2.47 million simulations. The divergence between click rates and credential submission rates is significant enough that an organization could look passable on one measure while being genuinely vulnerable on the other.
## The Reporting Signal Everyone Undervalues
The second metric the research elevates — employee reporting rates — deserves more attention than it typically gets.
When an employee receives a suspicious email and reports it to the security team, that's not just a compliance checkbox. That's your human threat intelligence layer activating. Security operations centers are expensive. Automated detection has gaps. But a well-trained employee population that consistently flags suspicious emails creates a distributed detection network that can surface phishing campaigns before they fully land.
Reporting rates also reveal something about organizational culture that click rates never can. Low reporting typically signals one of two things: employees don't know how to report (a tooling and friction problem), or they don't believe it matters (a trust and feedback problem). Both are fixable. But you can't fix what you're not measuring.
The research suggests that organizations with high reporting rates demonstrate more robust security postures than those with merely low click rates. An organization where 40% of employees click on simulated phishing but 60% of those immediately report it is in a fundamentally different position than one with a 10% click rate and near-zero reporting. The first organization has an engaged workforce that's paying attention. The second has a quiet workforce that might be clicking and not telling anyone.
## How the Compliance Industry Built the Wrong Dashboard
Here's the uncomfortable structural problem: the phishing simulation industry has strong incentives to keep selling click rates.
Click rates are easy to reduce. You run training, you run more simulations, click rates drop, you show improvement to auditors and leadership. It's a clean narrative. It satisfies compliance frameworks that require "documented security awareness training." It generates renewal revenue for vendors.
Credential submission rates are harder to move and harder to explain. "Our employees are still handing over passwords to convincing fake login pages despite three years of training" is not the kind of sentence that makes it into a positive audit finding.
This creates a situation where the security awareness training market has, arguably, organized itself around the metrics most favorable to demonstrating program value — rather than the metrics most predictive of actual breach risk. Organizations running annual phishing simulations to satisfy SOC 2 or cyber insurance requirements are checking boxes with data that may not reflect whether their employees would spot a real BEC campaign targeting their finance team.
## What Changes If You Take This Seriously
The operational implications for defenders are concrete.
Reconfigure your simulation platform. If your current phishing simulation vendor only reports click rates, you need either a configuration change or a vendor change. Credential-harvesting pages should be standard in your test templates, and submission rates should appear in every report that goes to leadership.
Fix your reporting pipeline first. Before you worry about improving reporting rates, make sure reporting is frictionless. If employees have to forward phishing emails to a security alias, find a buried menu option, or file a ticket to report suspicious messages, you've already lost most of your potential reporters. One-click reporting buttons in email clients exist and work.
Close the feedback loop. Employees who report suspicious emails should hear back within 24 hours — even if it's just "confirmed clean" or "good catch, we're investigating." The fastest way to kill reporting behavior is to create a black hole. If people believe their reports go nowhere, they stop reporting.
Segment your metrics by role. Finance, HR, and executive assistants face dramatically higher-quality phishing attempts in the real world. Your simulation data should tell you whether those populations are your highest credential-submission groups. If they are, that's where targeted training investment should go — not another company-wide click-through drilldown.
---
## HackWire Analysis
This research lands at an interesting moment in the security awareness training market. The category has been under sustained pressure from researchers questioning whether training programs actually reduce breach rates — several longitudinal studies have found weak or inconsistent correlations between training completion and real-world phishing susceptibility.
The click-rate fixation is partly a symptom of a broader problem: security programs measured against compliance requirements rather than security outcomes. Frameworks ask "did you train employees?" not "did your employees behave differently when confronted with real attacks?" The result is an industry optimized for answering the first question, which turns out to be substantially easier.
What makes this research more actionable than most SAT criticism is that it doesn't just tear down the existing metric — it proposes replacements that are actually measurable. Credential submission rates and reporting rates can both be tracked in existing simulation platforms. This isn't a "rethink your entire security culture" prescription; it's a "change two columns in your dashboard" prescription.
The pattern here connects to a broader shift in security measurement philosophy: moving from activity metrics (training completed, simulations run, click rates measured) toward outcome metrics (what actually happened when the test was real). Endpoint detection has largely made this shift over the past decade. Identity security is making it now, with credential-centric detection becoming a standard. Security awareness is overdue.
For organizations running phishing simulations primarily to satisfy compliance requirements, this research is worth taking back to your vendor or your program owner. The question to ask is simple: "What percentage of employees who clicked our simulated phishing emails actually submitted credentials?" If nobody knows the answer, that's the finding that should go in the next board report.
— HackWire Editorial
---
## Related Coverage