Phishing Simulation Results: How to Measure Security Awareness That Actually Changes Behaviour

By BCyber Security Team | CISSP, CISM Last updated: 10 August 2026

Phishing simulation results are only useful when they tell you something real about human behaviour. A training completion certificate may prove someone attended a session, but it does not prove they would pause before clicking a fake invoice or report a suspicious login page. That distinction matters because attackers do not care whether a course was finished; they care whether a person can be persuaded in the moment.

In BCyber’s GRACE Portal model, this belongs in the Education pillar, where the goal is measurable behaviour change, not a checkbox. It also aligns closely with BCyber’s Profiler behavioural intelligence platform, which helps security teams understand user activity patterns, repeat-risk exposure, and where human-factor controls need to be strengthened. For organisations using BCyber’s platform inventory of 22 policies, 9 processes, 50 courses, 788 published articles, 374 knowledge hub entries, 9 clients, and 12 fact-find assessments, the key lesson is the same: awareness only matters when it changes what people do.

Phishing remains effective because it still targets the fastest path into an organisation: trust, urgency, and distraction. When simulation results are read properly, they become evidence of where that trust is holding and where it is fraying. They can show whether awareness training is influencing decisions, whether reporting habits are improving, and whether certain teams need more targeted support. In other words, these results are not just numbers on a dashboard. They are a living signal of organisational resilience, or the lack of it.

This is especially relevant in Australian regulated environments. Under APRA CPS 234, entities are expected to maintain information security capability commensurate with threats and to test controls regularly. Under the Essential Eight, organisations are expected to harden identity and user controls because email-borne attacks remain a primary intrusion path. And under the Privacy Act 1988, a phishing event that leads to unauthorised access can quickly become a data handling and notification issue. In practice, that means simulation data is not just “training feedback” — it is evidence that can support governance, assurance, and control effectiveness discussions.

Why phishing simulation results are worth reading closely

Phishing simulation results are the measurable outcomes of controlled phishing tests sent to staff to see how they behave under pressure. Those outcomes usually include click rates, credential submission rates, report rates, open rates, and how quickly a message is escalated. They can also reveal whether the same people fail repeatedly, whether certain departments need more support, and whether security messages are landing in the right way. The value is not in the test itself, but in the evidence it produces. Used well, it becomes behavioural intelligence rather than a vanity metric.

A common mistake is to treat awareness as complete once a training module is finished. That approach measures participation, not retention or decision-making. Phishing simulation results give security, HR, and compliance teams a much more practical view of what people do when a suspicious message appears in the inbox. That is especially important for Australian organisations that must demonstrate reasonable care under APRA CPS 234, align identity and privilege controls to the Essential Eight, and maintain defensible privacy practices under the Privacy Act 1988.

For organisations mapping to NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022, phishing simulation outcomes sit at the intersection of Protect, Detect, and Respond. A good campaign can show whether users recognise suspicious content, whether they report quickly enough for security operations to intervene, and whether the organisation’s response workflow is fast enough to contain exposure. That is why simulation data should be read alongside process performance, not just awareness completion.

Good phishing simulation data should tell you where people are changing behaviour, where they are still exposed, and where the program needs to adapt.

The metrics that actually matter

Click rate and what it really means

Click rate is the proportion of users who clicked the simulated phishing link. It is often the first metric leaders look at because it is easy to understand and easy to compare across campaigns. A lower click rate can indicate better recognition of suspicious messages, but it should never be read in isolation. A team may click less yet still fail to report the message, which means the organisation has not gained a useful early warning signal. Click rate is a starting point, not the whole story.

In practice, the most useful way to read click rate is as part of a wider pattern. If click rates are falling over time and report rates are rising, the organisation is likely building stronger habits. If click rates are low but reporting is also weak, the program may have taught caution without teaching action. That is a subtle but important gap because a person who ignores a message does not necessarily help protect the rest of the business.

For example, a financial services team may become wary of obvious invoice fraud but still fail to report a convincing fake Microsoft 365 sign-in page. In that case, the security team may need to review both training and mailbox reporting workflow. BCyber’s GRACE Portal can help executives see this as a behaviour trend rather than a one-off event, while CyberTriage can support rapid incident handling when a reported message requires triage and containment. BCyber’s CyberTriage capability is designed for 4-minute triage, which matters when a suspicious message has already reached multiple inboxes.

Credential submission rate and exposure depth

Credential submission rate is more serious than a simple click because it shows how many users went as far as entering a password or other sensitive information into a fake form. That tells you the simulation did not just capture attention; it moved into the part of the attack where compromise becomes more likely. This metric is especially valuable for testing whether staff can recognise fake sign-in pages, account verification forms, or multi-factor prompts designed to harvest access. It gives a much clearer view of risk depth than click rate alone.

In healthcare, this could look like a phishing email impersonating a clinical system or patient portal, prompting a user to “re-authenticate” before accessing records. In government, it may present as a secure document notification requesting the recipient to enter domain credentials to view a policy update or grant file. In financial services, the lure may imitate a banking vendor, payroll change, or executive approval request. In all three sectors, credential submission is the point where a simulation stops being a simple awareness exercise and starts becoming a realistic test of identity control discipline.

This is also where the Essential Eight becomes relevant: phishing resilience is not just about user judgment, but about reducing the blast radius of compromised credentials through MFA, patching, restricted admin rights, and application control. BCyber’s Paradigm platform can support this by mapping policy and control expectations to compliance requirements, while Compliance Mapping and Policy Automation help teams evidence where user behaviour connects to control performance.

Report rate and fast reporting

Report rate measures how many users reported the simulation through the correct channel. This is one of the most important indicators of active defence because it shows that employees are not just avoiding risk, but helping the wider organisation respond to it. A strong report rate can reduce the window of exposure even if some users still interact with the message. That makes reporting behaviour a practical control, not just a good habit. In many cases, it matters more than a perfect click score.

Time-to-report adds another layer of insight. If staff recognise and report suspicious messages quickly, the security team can act sooner, mailbox controls can be tuned faster, and other users may be protected before the lure spreads. A delayed report may still be useful, but it is less operationally valuable. This is why simulation results should be read alongside incident response workflows and helpdesk processes. A good awareness program does not stop at recognition; it shortens response time.

For organisations using BCyber’s Perfect Storm scenario intelligence platform, this is where simulation and war-gaming meet. A phishing exercise can be combined with scenario modelling to test how quickly teams detect, escalate, and contain an identity-based threat once it starts moving. That approach is particularly valuable for organisations operating under APRA CPS 234 and ISO 27001, where control testing and response effectiveness matter as much as policy existence.

Repeat offenders and role-based patterns

Repeat exposure is where simulation results become especially useful for targeted improvement. If the same users or teams repeatedly click, submit credentials, or ignore reporting prompts, the issue is no longer a one-off mistake. It may reflect poor message relevance, weak reinforcement, or a gap in the way the training has been delivered. That is where adaptive learning becomes valuable, because the response can change based on observed behaviour. BCyber’s behavioural analytics approach through Profiler is designed to support that kind of tailored improvement.

Role-based analysis is just as important as individual review. Finance, HR, executives, IT, and frontline teams all face different phishing lures, and each group may need a different training mix. A finance team may see more invoice fraud, while an executive might face impersonation or urgent document approvals. Looking only at the whole-organisation average hides those differences and can lead to shallow conclusions. Segmenting by role, location, and business unit gives a much better picture of where the real risk sits.

BCyber’s 50 courses and 2 enrollments can be used to align content with the role and risk profile of each audience. For example, staff who handle payments may need deeper training on vendor verification and BEC indicators, while executives may need shorter, high-impact refreshers focused on impersonation, delegated authority abuse, and urgent instruction fraud. That is where Education in GRACE becomes practical rather than theoretical.

How to interpret simulation results without misleading yourself

One of the biggest mistakes organisations make is treating a single metric as proof of success. A low click rate sounds good, but it can be falsely reassuring if reporting is poor or if the campaign was too easy to be meaningful. The same problem happens in reverse when a difficult campaign produces worse numbers and leaders assume the awareness program has failed. Context matters more than the headline figure. Good interpretation means reading the entire pattern, not just the most flattering number.

Baselines are essential for that kind of reading. Results become meaningful when they are compared with previous campaigns, not just with broad benchmarks that may not reflect your workforce or threat profile. If click rates are trending down and report rates are trending up, you can reasonably say behaviour is improving. If the opposite is happening, the program may need adjustment even if the total numbers still look acceptable. Without a baseline, the organisation is guessing.

Campaign difficulty also has to be considered. A highly realistic simulation, especially one that uses internal language or current business themes, may produce poorer results than a simple template. That does not automatically mean the program is failing. It may mean the test is finally measuring something closer to real-world attacker behaviour. The job of the analyst is to read the result in context, not in isolation. That is how simulation data stays useful instead of becoming theatre.

A useful way to keep interpretation honest is to ask three questions:

1. Did users recognise the lure?
2. Did they report it quickly enough?
3. Did the organisation respond in a way that reduced exposure?

If the answer to any of these is “no,” then the result is not just an awareness metric — it is a control improvement opportunity.

Turning results into better behaviour

Phishing simulation results are only valuable when they feed back into improvement. The most direct response is targeted or adaptive training for people or teams that show higher risk exposure. That training should be specific to the behaviour observed, not generic and repetitive. If a team keeps falling for invoice fraud, the follow-up should focus on payment validation, urgency cues, and approval process discipline. If another team misses report opportunities, the training should emphasise what to do the moment a message looks wrong.

Role-based design strengthens that process even further. Different groups need different examples because their work patterns are different, and phishing lures usually mirror those patterns. A healthcare support team may need training around patient-related impersonation and urgent document requests, while a finance function may need more attention on vendor changes and bank detail fraud. A one-size-fits-all approach wastes attention and weakens retention. When the scenario fits the role, the lesson tends to stick better.

BCyber’s 50 courses and 788 published articles, supported by 374 knowledge hub entries, are useful here because they allow content to be sequenced rather than sprayed across the workforce. In practice, that means building a learning pathway: awareness first, then scenario-specific reinforcement, then process-based guidance for reporting and escalation. That approach is more consistent with NIST and ISO 27001 thinking than one-off annual training.

Simulation results should also influence the simulation program itself. If campaigns become too predictable, staff learn the test rather than the skill. Rotating themes such as invoice fraud, password reset prompts, MFA fatigue, and internal impersonation keeps the program realistic and prevents simulation fatigue. That variety helps preserve the value of the data because users are responding to changing conditions, not memorising a pattern. The goal is to build caution, not test recognition of a template library.

There is also a process side to this work. High report times, missed reports, or repeated uncertainty may indicate that the reporting channel is too hard to find or too slow to use. In that case, the answer may not be more training alone. It may be a simpler reporting button, clearer guidance in the mailbox, or tighter alignment between awareness content and incident response procedures. This is where education and operations meet. If the workflow is easy, the behaviour is more likely to repeat.

Leadership reporting should not drown decision-makers in raw data. Aggregated views from tools like BCyber’s GRACE Portal can translate behaviour data into risk insights that make sense to executives. That matters because leadership needs to see trends, patterns, and areas of concern, not every individual click. When combined with behaviour-based insight from Profiler, the organisation can understand where risk is concentrated and where targeted effort will matter most. This is how awareness becomes a managed capability rather than an annual campaign.

Real-world Australian scenarios where these metrics matter

Financial services

Healthcare

Government

Common mistakes that weaken the value of the data

A simulation program loses value quickly when it is run without follow-up. If staff click a lure and nothing happens afterwards, the test becomes a statistic with no learning loop. The same problem appears when leaders focus only on click rates and ignore reporting behaviour. That can create a false sense of control while operational exposure remains unchanged. A good awareness program needs response, reinforcement, and review.

Another frequent mistake is using repetitive or overly simple templates. When simulations become obvious, the workforce starts reacting to the pattern rather than the message. That produces numbers, but not insight. It can also create simulation fatigue, where people become disengaged because every test feels the same. Variety, realism, and relevance are what keep the evidence meaningful.

Punitive handling is another trap. If employees are shamed for failing a test, they may become less likely to report suspicious emails later. That undermines the entire purpose of the program. The better approach is to use results as a guide to coaching and system improvement. People learn more effectively when they can see progress, not just consequences. In that sense, the best phishing simulation programs behave like living systems: they observe, adapt, and strengthen over time.

BCyber credibility and assurance context

BCyber’s ecosystem is designed to connect awareness data with governance, reporting, and operational response. In addition to GRACE, Paradigm, Profiler, Perfect Storm, and CyberTriage, BCyber supports compliance and privacy-oriented work through Privacy in Depth. That matters because phishing simulation is rarely a standalone activity. It often feeds into policy review, control testing, incident response, and privacy governance.

BCyber has also been recognised as a 2025 Finalist Cybersecurity Professional Of The Year for Karen Stephens, Co-Founder & CEO, a 2025 GRC Provider of the Year — Finalist, and a 2025 AI Innovator - Cyber Security — Finalist. Those recognitions are relevant because they reflect a broader focus on governance, analytics, and practical security improvement rather than awareness in isolation.

Verification note

The behavioural guidance in this article is based on established phishing-awareness and control-testing practices. Where statistics or benchmarks are discussed, they should be validated against your own environment, sample size, and campaign design before being used for board reporting or compliance assurance. BCyber clients may map these results to frameworks including APRA CPS 234, the Essential Eight, NIST CSF, and ISO/IEC 27001:2022, depending on sector and regulatory obligation.

Sources and further reading

• Australian Cyber Security Centre (ACSC) – Essential Eight: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
• APRA CPS 234 Information Security: https://www.apra.gov.au/cps-234-information-security
• Australian Government – Privacy Act 1988: https://www.oaic.gov.au/privacy/the-privacy-act
• NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework
• NIST SP 800-50: Building an Information Technology Security Awareness and Training Program: https://csrc.nist.gov/publications/detail/sp/800-50/final
• ISO/IEC 27001:2022 overview: https://www.iso.org/standard/27001
• ACSC phishing guidance: https://www.cyber.gov.au/learn-basics/explore-basics/phishing

Key Takeaways

Phishing simulation results are most valuable when they measure behaviour change, not participation. Click rate matters, but report rate, credential submission rate, time-to-report, and repeat patterns usually tell a more complete story. Results should always be compared against baselines and read in context, especially when campaign difficulty changes. The strongest programs use this data to drive targeted training, role-based education, and process improvements rather than blame. When read properly, phishing simulation results become evidence that awareness is reducing risk, one decision at a time.