Phishing Click Rates Aren't the Metric That Matters

The Number Most Security Teams Report Is the Least Useful One

If your security awareness programme reports a single figure to leadership each quarter, it is almost certainly the phishing click rate. New research from Pistachio, an Oslo-based security training company, makes a well-evidenced case that this is the wrong number to lead with — and, more importantly, offers two better ones that most teams already collect without looking at.

The study analysed 354,962 simulations sent to 123,692 users across 648 organisations with complete twelve-month records, covering June 1, 2025 through May 31, 2026. That is a large enough dataset to say something useful about how behaviour changes over time rather than how one campaign performed.

• 354,962 simulations across 123,692 users in 648 organisations, June 2025 to May 2026
• Between months six and twelve, click rates fell 27% and credential leak rates fell 41%
• The report-to-click ratio improved from 1.3 at three months to 1.8 at twelve months
• Construction showed the highest exposure at a 41.31% click rate and 16.47% credential leaks

Why a Low Click Rate Can Mislead You

A click is one behaviour. What happens after the click is a different behaviour, and the two do not track each other neatly. Pistachio's data includes a finding that should stop anyone reading a click-rate dashboard: a small share of first-time simulation recipients leaked credentials despite not registering as having clicked. If your only instrument measures clicks, those people are invisible to you.

The sector breakdown makes the same point from another angle. Health showed low click rates but very weak reporting at 13.17%, which looks like success on a click dashboard and looks considerably less reassuring once you ask how many people flagged the message for anyone else. Logistics showed the inverse problem — above-average clicking with below-average reporting at 17.11%. Two very different failure modes, indistinguishable if you only count one thing.

The Two Metrics Worth Adding

First, credential submission. This is the behaviour that actually causes the incident, and it is the metric that improved most in the data — down 41% between the six and twelve month marks. Measuring it tells you whether training is changing the outcome rather than the reflex.

Second, the report-to-click ratio. Pistachio tracked this rising from 1.3 at three months to 1.8 at twelve, meaning that by the end of a year employees were reporting suspicious messages substantially more often than they engaged with them. That ratio is arguably the single best summary of a mature programme, because it measures the thing you actually want: a workforce that functions as a detection layer.

Does Awareness Training Improve Over Time?

Yes, but not in a straight line — and the shape is worth knowing before you present a chart. In the data, clicking and credential submission rose to a peak around the six-month mark before declining. A programme reviewed at month six in isolation would look like it was failing.

The improvement from six to twelve months also happened while simulation difficulty was rising, with roughly half of the scenarios classified as hard by the later period. Getting better results against harder tests is a meaningfully stronger claim than getting better results against the same test. The corollary is that a single annual simulation cannot produce this effect at all; the gains here belong to sustained programmes.

How to Act on This Next Week

Three concrete changes, none of which require new tooling for most teams. Add credential submission and the report-to-click ratio to whatever dashboard already shows click rate, and stop presenting click rate on its own. Segment by department rather than reporting an organisation-wide average, because the Health and Logistics patterns above show that averages hide opposite problems. And make reporting as close to one click as your mail client allows — the research points to simplifying that path as a direct lever on the ratio you want to move.

Our AI security coverage has looked at the technical side of this problem repeatedly, including how to spot and block invisible Unicode phishing and, more recently, the provenance tools that help you tell whether an image is real. Filters and provenance checks catch a great deal. The people reading the mail catch the rest, and this research is a useful reminder that we should measure them on what they do, not only on what they avoid.

Sources: Help Net Security — September 11, 2026; SecurityWeek — September 11, 2026.