Phishing Simulation Results: How to Measure User Susceptibility, Improve Security Awareness, and Reduce Human Risk

By BCyber Security Team | CISSP, CISM Last updated: 6 August 2026

Phishing still works because it follows people, not just systems. It lands in an inbox, a chat thread, or an SMS at a moment when someone is busy, distracted, or simply trying to keep work moving. That makes phishing simulation results more than campaign statistics, because they show how human judgment performs under realistic pressure.

When used well, those results become evidence of where an organisation is strong, where it is exposed, and where education can sharpen resilience. In BCyber’s GRACE Portal model, that evidence belongs in the education pillar, where learning replaces blame and improvement becomes measurable. The same results can also inform Profiler behavioural risk insights, while Perfect Storm can be used to model multi-stage social engineering scenarios that mirror real-world attack chains.

Verification note: The platform and program references in this article are based on BCyber platform inventory data: 21 policies, 8 processes, 50 courses (2 enrollments), 781 published articles, 374 knowledge hub entries, 9 clients, and 11 fact-find assessments. This article is educational in nature and does not disclose client-specific telemetry.

What phishing simulation results actually measure

The role of controlled simulations in human-risk assessment

Phishing simulation results are the measurable outputs from controlled exercises that test how users respond to fraudulent emails, SMS messages, collaboration prompts, or other social-engineering lures. The purpose is not to trap people for the sake of it, but to observe behaviour in a safe environment that mirrors real attacker techniques.

That distinction matters because a simulation should reveal how users react when a message looks urgent, legitimate, and plausible. It also helps organisations see whether security controls, reporting channels, and awareness programs are doing the work they are meant to do. In practical terms, the results become a diagnostic tool for human risk, not a scorecard for shaming.

A mature program treats these simulations as part of a living learning system. Each campaign adds another ring to the tree, showing where the canopy is healthy and where light is not reaching the understory. A simple click tells only part of the story, while a report sent within minutes may show that awareness is translating into action.

That is why BCyber’s Cyber Fitness approach is useful: it connects simulation, adaptive training, and behavioural analytics so the organisation can learn from each cycle. When GRACE Portal reporting and Profiler insights sit beside the simulation data, leaders can see patterns rather than isolated events. If a campaign indicates repeated credential submission against Microsoft 365 impersonation pages, for example, that insight can be used to refine controls, training, and escalation playbooks.

Why these results matter for security and compliance

Simulation results matter because they show whether awareness is taking root in daily behaviour. They reveal which lure types still succeed, whether users recognise suspicious patterns, and how quickly people escalate concerns when they are uncertain. They also help validate that training is more than a compliance checkbox by showing whether learning transfers into action.

For Australian organisations, that evidence can support audit readiness and control validation across frameworks such as:

• APRA CPS 234 for information security capability and testing
• the ACSC Essential Eight for baseline hardening and resilience
• the Privacy Act 1988 and Australian Privacy Principles for personal information protection
• ISO/IEC 27001 for information security management controls
• NIST Cybersecurity Framework for identify, protect, detect, respond, and recover alignment

Boards and executives do not need raw message traces, but they do need confidence that risk is being measured and reduced over time. In financial services, that often means demonstrating that phishing risk controls support APRA-aligned assurance activities. In healthcare, it may mean showing that staff can detect invoice fraud, credential harvesting, or patient-record impersonation attempts without delay. In government, it often means validating that staff can report suspicious messages quickly enough to protect sensitive or classified data.

These results also matter because they help prevent complacency. A program that reports high completion rates but never tests real behaviour can create a false sense of control. By contrast, simulated phishing exposes the gap between knowing and doing, which is often where risk hides. That gap can be closed, but only if organisations use the data to guide reinforcement, not punishment.

Education first, blame last

BCyber’s GRACE Portal perspective is simple: the objective is learning, not shame. When people fear being singled out, they are less likely to report suspicious messages quickly or honestly admit uncertainty. A blame-free model encourages more reporting, better engagement, and more reliable data because users stop trying to “game” the system.

That in turn makes the results more trustworthy and the training more effective. The aim is not to identify who failed, but to understand how the organisation can get stronger together. This approach also aligns with BCyber’s course ecosystem, including Security Awareness Fundamentals, Phishing Recognition and Reporting, and Human Risk Reduction pathways, which are designed to reinforce practical behaviours rather than simply confirm attendance.

The strongest phishing program is the one that turns near-misses into learning, not embarrassment.

That approach also supports a healthier security culture. Users who feel safe to report mistakes are more likely to surface genuine threats early, which can reduce dwell time in a real incident. Adaptive follow-up training can then target the exact behaviours that need reinforcement, whether that is spotting urgent language, checking sender details, or recognising identity prompts.

The metrics that reveal real susceptibility

Click rate, credential submission, and report rate

The most familiar metric is click rate, which measures the percentage of recipients who clicked a malicious link or opened a harmful attachment in the simulation. It is useful because it shows initial susceptibility to a lure, especially when a message is designed to create urgency or curiosity.

But click rate on its own is incomplete, because it does not tell you whether the person then reported the email, stopped at the landing page, or recognised the test after interaction. A campaign with a moderate click rate and a strong report rate may indicate a maturing workforce. A low click rate with poor reporting may still point to a weak security posture.

Credential submission rate is often more serious, because it measures how many people entered usernames, passwords, or other identity data into a fake login page. That behaviour suggests the lure successfully crossed from attention to compromise. In a real incident, credential capture can lead to mailbox access, internal pivoting, and business email compromise. For that reason, credential submission is one of the clearest indicators of account exposure risk.

Report rate is the metric that often gets overlooked, even though it can be one of the strongest indicators of resilience. When users report suspicious messages quickly, they create a chance for security teams to warn others, block related indicators, and contain risk sooner. A team with some clicks but strong reporting may be more prepared than a team that never engages but never speaks up either.

Open rate, engagement, and time-to-report

Open rate measures how many users opened the simulated message, while engagement rate captures deeper interaction such as replying, forwarding, downloading an attachment, or following links in the message. These metrics are useful because they can reveal whether subject lines, sender names, and delivery timing are convincing enough to create attention.

In email-based simulations, an open does not always mean risk, but it does show that the message reached the user and drew interest. In collaboration platforms or SMS, engagement can look different, so the metric should be interpreted in the context of the channel. The point is to understand behaviour, not just count events.

Failure time and time-to-report add another layer of operational meaning. Failure time shows how quickly a user clicks or submits credentials after receiving the lure, which matters because real attackers often rely on speed and urgency. Time-to-report shows how quickly suspicious content reaches the security team, which can be critical in narrowing exposure.

If one team reports within minutes while another waits hours, the difference is operationally significant. Those time-based metrics are often more actionable than a headline percentage because they show how quickly the organisation can respond under pressure. In BCyber’s CyberTriage workflow, rapid triage can help security teams prioritise phishing-derived incidents and determine whether follow-on containment actions are needed.

Segmenting by role, department, and location

Simulation results become far more useful when they are segmented. A single organisation can contain multiple risk profiles across departments, roles, locations, device types, and seniority levels. Finance may be more exposed to invoice fraud, while human resources may face recruitment-themed impersonation, and executives may receive more targeted account takeovers.

Remote staff may interact differently from office-based teams, and mobile users often face different constraints than desktop users. When results are broken down properly, leaders can see where risk clusters rather than assuming the whole organisation behaves the same way. This is especially important in financial services, where finance teams often face payment diversion attempts; in healthcare, where clinicians and admin staff may receive urgent credential-reset messages; and in government, where staff may be targeted with service or benefits impersonation.

This is where behavioural analytics can add real depth. Tools like BCyber Profiler can help identify recurring patterns, such as repeated vulnerability to the same lure type or delayed reporting from a particular function. That level of insight supports more precise training and more relevant simulations. It also helps avoid broad assumptions that dilute effort across the wrong audience.

The better the segmentation, the more the program behaves like a forest learning from its own growth patterns.

Reading good results and bad results in context

Why one campaign never tells the whole story

A single campaign result should never be treated as the final word on security awareness. A high click rate may look alarming, but it may reflect a very convincing lure, a new employee cohort, or a campaign that was intentionally designed to test difficult scenarios. Likewise, a low click rate may look impressive while hiding poor reporting, shallow engagement, or an audience that simply recognised a familiar template.

The value comes from comparison, not isolation. Baseline data and trend analysis are what turn a campaign into evidence. This is one reason BCyber’s TopSpin analytics approach can be useful for trend analysis and capacity planning around awareness programs, especially when organisations want to understand whether improvements are sustained or just temporary.

It is also important to remember that simulation design affects the outcome. If the message is too simplistic, users may learn to spot the test rather than the risk. If the lure is too complex or too realistic without clear guardrails, the data may reflect campaign artifice rather than real-world readiness. Repeating the same template again and again can also distort outcomes because people begin to anticipate the format.

Good measurement requires enough variety to avoid predictability, but enough consistency to support comparison. That balance is part science, part operational discipline.

Signs that improvement is real

Some of the strongest indicators are not flashy, but they are meaningful. A declining click rate across repeated campaigns suggests users are learning to recognise common patterns. A rising report rate shows that people are becoming more confident in escalating concerns. Faster time-to-report indicates operational maturity, because the security function is being engaged earlier. Reduced variance across high-risk groups can also show that targeted reinforcement is working.

Those are signs of real progress, even if perfection is still out of reach. Improvement also shows up when targeted training leads to better behaviour in later simulations. If a group struggles with credential harvesting and then performs better after adaptive instruction, that is practical evidence of value. The same is true when managers, contractors, or new starters improve after role-specific reinforcement.

The goal is not to produce identical scores across every group, but to close meaningful gaps. Good results are therefore measured by movement, not by vanity. This is consistent with NIST and ISO 27001 thinking: controls should be assessed for effectiveness, monitored over time, and improved when evidence shows a gap.

Common misreads that weaken programs

One common mistake is to treat a single click as a permanent label. Users do not become “unsafe” because they made one mistake, and that kind of thinking can damage trust. Another error is comparing different departments without accounting for role, exposure, or message relevance.

A finance team receiving invoice fraud simulations cannot be measured the same way as a technical team receiving software update lures. Context is not a convenience; it is essential for interpretation. Another misread is relying too heavily on completion metrics from training platforms. Course completion does not always translate into changed behaviour, and simulation results often reveal that gap.

A program can also become too focused on raw percentages while ignoring whether people are reporting faster or whether the organisation is detecting risk earlier. The best programs ask what changed, why it changed, and what needs to happen next. That is where the data becomes useful.

Turning simulation data into better behaviour

Personalised training that matches real risk

The most effective response to simulation results is targeted reinforcement. If a user group struggles with urgent language, the follow-up should focus on pressure tactics, deadlines, and emotional triggers. If another group is vulnerable to login-page impersonation, the training should focus on URL inspection, sender validation, and identity checks.

This is where adaptive learning outperforms generic reminders, because it meets people where their risk actually sits. BCyber Cyber Fitness supports that model by aligning training pathways to observed behaviour rather than assuming everyone needs the same lesson. It can be delivered through structured learning assets in BCyber’s knowledge base, including its 374 knowledge hub entries and relevant course pathways.

Personalisation matters because people learn in different ways and at different speeds. A one-size-fits-all module may satisfy a policy requirement, but it rarely addresses specific weaknesses with enough precision. Adaptive training can be short, focused, and contextual, which makes it easier for busy staff to absorb and remember.

Reinforcing the behaviours you want to grow

Strong programs do not only correct mistakes; they also reinforce success. When users report suspicious messages quickly, that behaviour should be recognised in a way that supports a positive culture. Recognition can be simple, such as team acknowledgements, progress dashboards, or light gamification that rewards vigilance.

The point is to make good behaviour visible, because what gets noticed tends to get repeated. If reporting is framed as an organisational strength, people are more likely to use it. That reinforcement should include the response process as well. Users need to know that reporting leads to action, not silence.

If they see that their report resulted in a warning to colleagues or a blocked campaign, they are more likely to continue participating. This feedback loop makes the reporting habit feel worthwhile. It also strengthens trust between staff and security teams and supports the intent of the GRACE Portal executive reporting and compliance tracking functions.

Improving the simulation program itself

Simulation design should evolve alongside user maturity. Early campaigns may focus on common email lures, but later testing should include collaboration tools, SMS, file-sharing notifications, and more targeted social engineering. Rotating templates helps prevent predictability and keeps the results meaningful. Adjusting difficulty over time also lets the organisation see whether awareness is actually improving.

A program that never changes can become stale, while one that evolves can keep teaching. It is also worth testing channels that reflect how people actually work. Many organisations now rely on mobile devices, chat platforms, and shared documents just as much as email. If the simulation program ignores those channels, it leaves a blind spot in the measurement.

Real attackers do not respect channel boundaries, so the program should not either. Good simulations reflect the threat landscape the organisation actually faces. BCyber’s Perfect Storm scenario modelling can be used to test compound threat paths, including phishing followed by session hijacking or MFA fatigue, which is increasingly relevant in modern identity-led environments.

Reporting results to leaders, auditors, and teams

What each audience needs to see

Executives usually want the broad story: where risk sits, whether it is improving, and how it affects business resilience. They do not need every campaign detail, but they do need a clear picture of trend lines, high-risk groups, and progress over time. Security and IT teams, by contrast, need detailed metrics such as lure performance, segment breakdowns, and time-to-report data.

Compliance and audit teams need evidence that awareness is active, measurable, and connected to policy obligations. The same data can serve all three audiences, but the presentation must change. For Australian organisations, that often means mapping phishing simulation results to policy and control language used in APRA CPS 234 assurance packs, Essential Eight uplift plans, or ISO 27001 internal audit findings.

BCyber’s GRACE Portal is designed to make that easier by providing a single dashboard with cross-product analytics, executive reporting, compliance tracking, and real-time monitoring. That makes it easier to align simulation outcomes with broader security posture reporting across business and technical stakeholders.

Presenting findings without drowning people in data

Dashboards, trend lines, and segment comparisons are usually more effective than long tables of raw results. Visuals make it easier to see whether risk is moving up, down, or sideways, especially for non-technical stakeholders. Context is essential, so each report should explain why a metric matters and what changed since the last cycle.

A chart without interpretation can create confusion, while a well-framed summary can create alignment. In practice, good reporting helps the organisation focus its attention where it matters most. It should also reference the control environment in plain language: for example, “reporting improved after targeted training for finance staff handling supplier payments” is more useful than “click rate decreased by 12%.”

It is also important to avoid the trap of celebrating only good news. Reports that hide vulnerable groups or unfavourable trends do not build trust. Leaders need a realistic view of both progress and exposure so they can invest wisely. The best reports are honest, specific, and easy to act on.

Building a continuous learning loop

How mature programs keep improving

The strongest phishing simulation programs follow a repeatable loop: run the simulation, analyse the results, deliver targeted education, and retest. Each cycle produces more insight, because the organisation is learning from actual behaviour instead of assumptions. Over time, this creates a living knowledge base that grows organically as new patterns emerge.

The forest strengthens because it is fed by shared understanding. That is the kind of self-learning and self-healing approach modern security awareness needs. BCyber’s platform ecosystem supports that loop across education, behavioural intelligence, and response: GRACE Portal for visibility, Profiler for behavioural analysis, CyberTriage for incident response prioritisation, and Paradigm for governance and compliance mapping.

Maturity also means avoiding fatigue. If the same style of simulation appears too often, users can become desensitised or overly cautious in ways that do not reflect real behaviour. Variety, realism, and thoughtful timing help keep the data meaningful. It is also useful to coordinate simulation campaigns with broader awareness messaging so that lessons reinforce each other.

Common pitfalls to avoid

The biggest pitfall is using simulations to embarrass staff. That approach can reduce reporting and make people hide mistakes, which weakens the very controls the program is trying to strengthen. Another common problem is obsessing over click rate alone while ignoring reporting behaviour, time-to-report, and repeat susceptibility. Repeating the same template too often is another easy mistake, because it teaches recognition of the test rather than the threat.

Failing to act on findings is perhaps the most damaging issue of all, because it turns measurement into theatre. Programs also lose value when they ignore the wider environment. If simulations are run without supporting education, process improvement, or leadership visibility, the results will stall. Human risk is not fixed by a single campaign; it is shaped by systems, habits, and reinforcement.

That is why integration matters. When simulation, training, analytics, and reporting work together, the organisation can adapt as threats change. BCyber’s recognition as a 2025 Finalist Cybersecurity Professional of the Year for Karen Stephens, Co-Founder & CEO, as well as a 2025 GRC Provider of the Year — Finalist and 2025 AI Innovator - Cyber Security — Finalist, reflects the market relevance of this integrated approach.

Real-world examples by sector

Financial services: invoice fraud and executive impersonation

In a mid-sized financial services firm, a phishing simulation may use supplier invoice language with a spoofed domain that looks nearly identical to a real vendor. If accounts payable staff click but do not submit credentials, the result suggests the message was persuasive but the login stage still failed. If the report rate rises after coaching, that is a strong indicator that staff are learning to pause and escalate.

For APRA-regulated entities, this is especially relevant because phishing often acts as the entry point to larger control failures. The resulting data can be used to support control effectiveness reviews under APRA CPS 234 and to demonstrate that staff are being tested against realistic fraud tactics.

Healthcare: credential-reset and patient-record impersonation

In healthcare, phishing simulations often mimic password resets, pathology notifications, or urgent patient referrals. These lures exploit time pressure and clinical workflow disruption. A successful simulation in a hospital environment may show that staff understand the risk but still respond when the message appears operationally urgent.

That is exactly the kind of human-factor risk that awareness programs need to surface. Results can be used to refine training for front-desk staff, clinicians, and contractors who access shared systems. It also supports privacy and data-protection obligations where protected health information or sensitive personal data is involved.

Government: service notices and benefits-related impersonation

In government environments, simulations may use tax, benefits, or service-notice themes. These are effective because they map to public-facing communication patterns users already recognise. A government agency may find that mobile users click more often than desktop users, especially when the lure arrives by SMS or collaboration notification.

That finding can inform both training and technical controls, including MFA hardening, URL filtering, and reporting workflow design. It also supports broader Essential Eight maturity uplift by reducing the chance that a simple lure becomes a compromised account.

Key frameworks and sources used to interpret phishing results

The following references are useful when benchmarking phishing simulation and awareness programs:

1. ACSC Essential Eight — mitigation strategies and maturity expectations

1. APRA CPS 234 Information Security — information security capability and control assurance

1. NIST SP 800-50 — Building an Information Technology Security Awareness and Training Program

1. NIST Cybersecurity Framework (CSF) — risk management and control alignment

1. ISO/IEC 27001 — information security management system requirements

1. ACSC guidance on phishing — practical user guidance and reporting behaviours

1. Australian Privacy Act 1988 — privacy obligations relevant to phishing-related exposure

Key Takeaways

Phishing simulation results are not just campaign numbers; they are evidence of how people, processes, and training behave under realistic pressure. The most useful metrics go beyond click rate and include credential submission, report rate, time-to-report, and segmented behavioural patterns. Results should always be interpreted in context, with baselines, trends, and audience differences in mind.

When organisations use the data to personalise training, reinforce good behaviour, and refine simulation design, they build measurable resilience. The real value is not perfection, but steady improvement in human risk management.

About BCyber

BCyber’s cyber resilience ecosystem includes:

• GRACE Portal — unified cyber resilience platform with single dashboard, cross-product analytics, executive reporting, compliance tracking, and real-time monitoring
• Paradigm — AI self-learning GRC platform for governance, risk, and compliance automation
• Profiler — behavioural intelligence platform for insider threat and human-risk analysis
• TopSpin — cybersecurity storage forecasting and analytics hub
• CyberTriage — AI-powered incident response platform with 4-minute triage
• Perfect Storm — scenario intelligence for threat simulation and resilience testing
• Privacy in Depth — privacy management solutions for Australian compliance needs

This article references BCyber’s platform inventory of 21 policies, 8 processes, 50 courses, 781 published articles, 374 knowledge hub entries, 9 clients, and 11 fact-find assessments to provide context for the educational approach described above.