Simulated Phishing for Businesses: The 5 Metrics That Really Matter
1. Introduction
Simulated phishing for businesses is the most effective exercise available to measure and improve how your employees actually respond to a malicious email. It consists of sending messages that are practically identical to a real phishing attack, in a controlled and authorized environment, to observe what your workforce does before a real attacker finds out for you.
For years, cybersecurity training was limited to annual courses that nobody remembers. A simulated phishing for businesses program changes the paradigm: instead of talking about threats in the abstract, every employee faces a concrete scenario and receives immediate feedback. Results are measured, compared and improved month after month.
In this article we cover the real state of the threat, the five metrics that should govern your program, the tools available and the two pieces that separate a mediocre program from an excellent one: micro-training and a no-blame culture.
2. The Real State of the Threat
Email remains the number one entry vector for corporate attacks. According to APWG quarterly data, 989,123 phishing attacks were recorded in the fourth quarter of 2024 alone, and the figure keeps growing. Phishing is the initial mechanism behind most serious incidents: ransomware, BEC, data exfiltration and account compromise all start with a single click.
The industry publishes figures that should worry any executive. According to the Verizon DBIR 2024, the average user clicks a phishing link just 21 seconds after opening the email, and needs 28 more seconds to type their credentials into the fake page. In other words, less than a minute passes between opening the message and handing over the password. And phishing is no longer recognizable at a glance: generative AI has eliminated spelling mistakes and the classic telltale signs, so training must use current scenarios, not examples from ten years ago.
The goal of a simulation program is not to “catch” anyone, but to generate data: how many people fall for it, how many report it and how many fall for it again. With that data, you prioritize training, technical controls and risk segments with surgical precision.
3. The 5 Metrics That Really Matter
A dashboard full of numbers is useless if you do not know which ones govern the program. In a simulated phishing for businesses program, five metrics concentrate 90% of the value:
| Metric | What it measures | Reasonable target |
|---|---|---|
| Click rate | % of employees who open the link | Reduce month over month toward 5% |
| Credential rate | % who submit username and password | The most severe; target near 0% |
| Reporting rate | % who report the suspicious email | The most relevant; target rising |
| Repeat rate | % who fall again in different scenarios | Spot segments that need reinforcement |
| Coverage | % of staff simulated and frequency | 100% of personnel, at least monthly |
Fig. 1 – The five metrics of a simulated phishing for businesses program.
The click rate measures initial exposure and works as a global thermometer, but it is not the number that should keep you up at night: many clicks lead nowhere if the email gateway blocks the malicious content. The credential rate is critical, because it means the employee passed the final step of the deception and the attacker got what they were after.
The reporting rate is the most relevant metric of the program: it measures the probability that a real attack is neutralized by employees themselves before it causes damage. An 80% reporting rate turns your workforce into an extension of the SOC. If the reporting rate is low, you have a channel problem, not a willingness problem: there is no accessible report button and no visible feedback loop.
The repeat rate identifies the segments that are not learning: a department that falls again and again despite reinforcement needs a different intervention, not more of the same simulations. Coverage, finally, guarantees that the program does not forget anyone: contractors, interns and executives included, because spear phishing against executives (whaling) is precisely the most expensive kind.
The recent trend is double: click rates keep falling and reporting rates keep rising in mature programs, but credential submission remains stubbornly stable, because the most deceptive scenarios are usually targeted ones. The spear variant, which personalizes the message with reconnaissance from LinkedIn, the news or public breaches, succeeds by orders of magnitude more than generic campaigns. Your simulator should reflect that: a small percentage of campaigns should target specific roles with personalized pretexts, mirroring what the attacker actually does.
4. How to Launch a Simulated Phishing Campaign
Tools have matured enough for a medium-sized business to run its own program with limited resources. The ecosystem includes commercial platforms such as KnowBe4, Proofpoint SAT, Cofense or Hoxhunt, the integrated Microsoft 365 Attack Simulator, and open-source options like Gophish, which we use in our labs and you can deploy on your own infrastructure:
# Basic Gophish deployment for a pilot campaign
docker run -p 3333:3333 -p 80:80 gophish/gophish
# 1. Sending profile: your own SMTP, neutral sender (no real brand)
# 2. Landing page: fake page described in the program whitelist
# 3. Template: subject and body with a low-suspicion scenario
# 4. Campaign: pilot group of 10%, 48-hour window
# Clicks, credentials and reports are logged in the dashboard
Fig. 2 – Minimum steps to launch a campaign with Gophish.
Frequency matters more than sophistication: a sustained monthly campaign produces better results than one spectacular annual exercise, because the real attacker does not wait for your calendar. Rotate scenarios by style (invoices, credential phishing, attachments) and segment by department, so finance and HR teams receive scenarios consistent with their actual work.
Always start with a small pilot and low-risk scenarios: external senders, no branding, to calibrate the tool and the alerts before exposing the workforce. If you want to build the lab yourself, we explain how to run a phishing campaign with Gophish step by step.
5. Micro-Training and the Report Button
The first piece that separates effective programs from the rest is micro-training at the moment of maximum learning. When an employee falls for the simulation, a two- or three-minute screen appears immediately, explaining the concrete indicators of the email: suspicious domain, external sender, manufactured urgency, redirecting link. That is the famous teachable moment: at that instant the employee is more receptive than ever and retains the lesson for weeks.
The second piece is the Report Phishing button: an email client add-in that lets users flag any suspicious message with one click. The button connects directly to the SOC or the email gateway, where the message is analyzed and, if malicious, purged from all mailboxes. Every button report serves three purposes: it protects the rest of the company, feeds threat intelligence and reinforces the correct behavior of the employee.
A mature program rewards reporting: if an employee reports the real campaign, they receive recognition for doing exactly the right thing, even if the tool marks a theoretical “failure”. The list of training and awareness resources in cybersecurity helps you build the content of these micro-sessions.
6. No-Blame Culture: The Foundation of the Program
The no-blame culture is the success condition of the entire program. If the employee who falls for a simulation receives an email copying their manager, they will learn to hide the next mistake instead of fixing it. And the mistake that is hidden can be real. The rule is simple: never sanction someone who falls for a simulation or someone who reports; do review the case of anyone who repeatedly fails without improvement, and always from a training perspective, never a punitive one.
Results are published in aggregate: click rate by department, quarterly evolution, no individual names. And leadership participates under identical conditions: when an executive falls in front of their team and jokes about it, they demonstrate that security is not someone else’s problem. That normalization multiplies reporting and reduces the shame that fuels silent incidents.
7. Simulated Phishing Within Defense in Depth
Let us be honest: simulated phishing for businesses measures and improves the human factor, but it does not replace technical controls. Defense in depth requires running simulation and email hardening at the same time. The first front is domain authentication: SPF with strict fails (“-all”), DKIM and above all DMARC, which should evolve from none to p=reject with aggregate reports; in reject mode, direct impersonation of your domain is eliminated completely, and that impersonation is the basis of many attacks.
The second front is MFA. Advanced campaigns no longer steal only passwords: AiTM (adversary-in-the-middle) attacks using tools like Evilginx act as a TLS proxy between the victim and the legitimate service, capture the session cookie obtained after the second factor, and bypass SMS, TOTP and even push. Only FIDO2/WebAuthn factors, such as security keys or passkeys, resist AiTM, and they should be mandatory at least for critical and privileged accounts.
Around these two fronts, keep the email gateway with attachment sandboxing and time-of-click URL rewriting, and harden response: if an employee submits credentials in a real campaign, rotate passwords and revoke all active sessions immediately, then review what else was simulated. Regular exercises make sure those processes are practiced before they are needed.
8. Conclusion
Simulated phishing for businesses is today’s awareness investment with the best known return: it turns the workforce into a measurable security control, improves internal detection and prepares response processes with real data from your own organization. Five metrics are enough to steer it well: clicks, credentials, reporting, repeats and coverage.
The winning combination is technically simple and culturally demanding: monthly campaigns with the right tools, immediate micro-training, a report button connected to the SOC and a no-blame culture sustained from the top down. Doing it costs far less than absorbing the first real campaign that picks your company as its target.
Need help with Simulated phishing for businesses?
At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.
Contact us for a free infrastructure assessment.
