[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI6iJnm2tRjm8JoZYUWA-PicdnL5hdbOkzJ5fT3_sI_o":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"4e2587f8-4ee1-402c-a98a-c01e909cb088","click-rates-alone-dont-measure-phishing-risk-heres-what-does","cbfb63f5-b868-4c59-bdb8-3718ec1cb5fa","Click Rates Alone Don't Measure Phishing Risk — Here's What Does","Organizations have long relied on phishing simulation click rates as the primary metric for measuring employee security awareness, but new research shows this approach is fundamentally flawed. Analyzing 2.47 million simulated attacks, Pistachio's study found that click rates fail to capture the full risk picture — credential submission rates and user reporting behaviors are far more predictive of real-world vulnerability. An employee who clicks but doesn't submit credentials represents a very different risk profile than one who hands over their password. Without measuring the right indicators, security teams may have a false sense of confidence in their workforce's resilience. This matters because phishing remains one of the leading initial access vectors in breaches, and miscalibrated training programs leave critical gaps unaddressed.","**Immediate actions:**\n- Expand phishing simulation metrics beyond click rates to include credential submission rates and user-reported phishing attempts.\n- Audit your current security awareness platform to confirm it supports multi-dimensional behavioral tracking and reporting dashboards.\n\n**Long-term improvements:**\n- Redesign security awareness training programs to reward and reinforce reporting behavior, not just punish clicks.\n- Establish baseline benchmarks for credential leak rates and reporting rates across departments to track meaningful progress over time.\n- Tailor phishing simulations by role and risk level, ensuring high-value targets (finance, IT, executives) receive more frequent and sophisticated scenarios.\n\n**Detection & measurement:**\n- Integrate phishing simulation data with your SIEM to correlate training outcomes with real-world phishing incident trends.\n- Define KPIs that include 'report rate,' 'credential submission rate,' and 'repeat offender rate' in quarterly security awareness reviews.",[12,13,14,15,16,17,18,19],"CIS Control 14: Security Awareness and Skills Training","CIS Control 8: Audit Log Management","NIST SP 800-50: Building an Information Technology Security Awareness and Training Program","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 AT-3: Role-Based Training","NIST CSF DE.CM-3: Personnel activity monitoring","GDPR Article 39: Tasks of the Data Protection Officer (training obligations)","ISO 27001 Annex A.7.2.2: Information Security Awareness, Education and Training",{},"published","2026-09-11T18:20:44.500345+00:00","2026-09-11T18:20:44.184+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fwww.securityweek.com\u002Fphishing-research-challenges-conventional-security-awareness-testing\u002F","phishing-research-challenges-conventional-security-awareness-testing-a9a3d7","Phishing Research Challenges Conventional Security Awareness Testing",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[43,47],{"slug":44,"name":45,"problem":46},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":48,"name":49,"problem":50},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]