Phishing Simulations Need to Measure Reporting and Response, Not Just Clicks

Phishing simulations that focus on whether employees click a link can miss the behavior that matters most during a real attack: how quickly someone reports the message, and how well the organization responds. As AI helps attackers write more convincing, personalized lures, security teams need to test both employee judgment and operational readiness.

That shift matters because training built around spelling errors, generic greetings and odd formatting can leave employees unprepared for messages that use familiar names, business context and professional language. The aim should be to teach people to verify unexpected requests through a trusted channel, even when the message looks legitimate.

AI raises the bar for phishing tests

Generative AI can help attackers personalize lures and improve their writing. That doesn’t mean every phishing campaign uses AI, but it does make familiar warning signs less dependable.

A 2025 SC Media report on Egress research found that 75% of the phishing kits examined on dark-web markets advertised AI capabilities, while 82% offered deepfake features. Those figures describe the kits in the research, not phishing activity as a whole. Still, they show that AI features are available in tools used by criminals. Recent reports of phishing attacks using AI prompt injections add another reason for security teams to revisit what their exercises measure.

Simulations should reflect plausible business situations, such as unexpected document sharing, supplier requests and messages impersonating trusted colleagues. Employees need practice checking unusual requests and reporting suspected attacks without fear of embarrassment or punishment. That can require custom mailboxes, new exercise designs and several levels of approval, but it gives teams a more useful picture of readiness.

Click rates leave out the response

Click rates, credential submissions and message deletions are easy to count and compare. They don’t show whether employees use the approved reporting channel or how quickly a suspicious message reaches security analysts.

Consider two teams with the same click rate. In one, employees report suspicious messages promptly, giving security staff time to investigate, find other recipients and issue a warning. In the other, people delete or ignore the messages. The headline metric is identical, but the organization’s ability to detect a live campaign differs.

Reporting rates and time to report should sit alongside click rates in awareness metrics. Teams should also assess whether reports lead to action: can analysts contact other recipients, remove a message from inboxes, block malicious infrastructure and investigate possible account compromise? The National Cyber Security Centre’s phishing guidance offers practical advice on recognizing and reporting suspicious messages; organizations can make it available through their websites or HR portals.

Read simulation results with care

A controlled exercise can expose weaknesses, but it can’t guarantee how a person will respond to a real attack. Results may reflect familiarity with repeated templates, and a simulated click alone doesn’t establish that the employee would compromise the organization in an actual incident. A person’s circumstances at the time can also affect their response.

Use the results to improve security rather than rank employees by pass and fail rates. That purpose should shape how teams discuss mistakes: employees need to feel able to report suspicious messages quickly, including when they’ve already clicked.

Connect awareness to incident readiness

Phishing exercises should test what happens after a suspicious message arrives. Security teams can measure how quickly employees report it and whether analysts can trace other recipients, contain the message and check for account compromise. This links awareness work to the response capabilities an organization needs when an attack gets through.

Incident exercises should bring security, IT, finance and relevant business teams together so each knows what to do when a real phishing attack succeeds. No training program will prevent every click. A program that improves reporting and response can still help limit the damage.

Yesterday’s tests can still offer useful lessons, but they shouldn’t define tomorrow’s readiness. The practical test is whether an organization can verify a convincing message, detect who may have acted on it and respond before the impact spreads.