Terravek has run quarterly phishing simulations since 2018. For the first two years we measured one number: the click rate. It went from 21% to 7%, we congratulated ourselves, and we were measuring the wrong thing.
The number that matters is the reporting rate — the proportion of people who receive a suspicious message and tell someone. Ours had gone down too, from 34% to 22%, because we had taught people that the correct response to a suspicious email is to not click it and move on.
That is a disaster in slow motion. A click that gets reported within five minutes is a manageable incident. A targeted email that nobody clicks and nobody reports is a campaign we know nothing about, still running.
We changed three things. We stopped publishing click-rate league tables by department, which had been generating exactly the shame-driven silence you would expect. We put a report button in the mail client so reporting takes one action rather than five. And we started responding to every report, including the false positives, with a short thank-you from a named human in the SOC.
Reporting rate is now 61%. Click rate went up slightly, to 9%, and I do not care.