Phishing Simulation Click Rate
Percentage of employees who click on simulated phishing emails
What is Phishing Simulation Click Rate?
Phishing simulation click rate is the percentage of employees who click a link in a simulated phishing email. It shows how susceptible staff are to real phishing attacks.
Phishing is a leading route for attacks, so awareness training and testing are important defences.
How this KPI is measured
- Function
- Information Technology
- Sub-function
- Cyber Security
- Industry
- All Industries
- Type
- Leading
- Impact
- Risk
- Unit
- %
- Measurement frequency
- Quarterly
- Formula
- (Employees clicking simulated phishing link / Total employees tested) × 100
How to calculate it
Divide employees clicking the simulated phishing link by total employees tested, and multiply by 100.
For example, if 60 of 1,000 employees clicked, the rate is 6%.
Run simulations regularly with varied difficulty, and track reporting of phishing as well as clicks, since staff who report suspicious emails are a strong defence.
Where it is used
Measuring awareness
See how staff respond.
Targeting training
Support those who need it.
Tracking improvement
Show progress over time.
How to improve it
Tips and common mistakes
- Do not punish people for clicking. It discourages reporting.
- Track report rate as well as click rate.
- Vary difficulty to reflect real attacks.
More Information Technology kpi library
Build better plans, faster
Join the waitlist for early access to curated insights, flexible templates, and rapid iteration across strategy, planning, and project management.