Sagar Gadaily
Back to Blog
CybersecurityOctober 3, 20264 min read

Phishing Simulations That Teach Instead of Shame

Recent research suggests that typical phishing training barely changes click rates. Here is what that means for security awareness teams, and how to redesign simulations around reporting, realistic practice and respect.

Phishing Simulations That Teach Instead of Shame

Phishing simulations are fake phishing emails sent by an organization to its own employees to measure and improve how people respond to real attacks. Done well, they build a reporting habit and give people safe practice. Done badly, they become a "gotcha" exercise that erodes trust and teaches very little.

The stakes are real. Verizon's 2026 Data Breach Investigations Report found that the human element was involved in roughly 62% of breaches. But the uncomfortable news for awareness teams is that the most common training formats don't appear to move the needle much.

💡
Key takeaways: Large studies show conventional phishing training has small effects on click rates. Measure reporting, not just clicking. Replace "you failed" landing pages with short, specific practice. Never use simulations to shame or punish. Pair training with technical controls, because people will always click sometimes.

What the research found

A study presented at the 2025 IEEE Symposium on Security and Privacy, led by researchers at UC San Diego, followed more than 19,500 employees at a large healthcare organization over eight months. It found no significant relationship between recently completing annual security awareness training and falling for simulated phishing, and only a very small difference for employees who completed the embedded training shown after a failed simulation. Many employees spent only seconds on those training pages.

An earlier large-scale study by Lain and colleagues at ETH Zurich (IEEE S&P 2022), with more than 14,000 participants, reached a similar conclusion about embedded training and also found that employees became good at collectively reporting phishing over time.

The takeaway isn't "stop training." It's that the standard format, a click-triggered lecture page, is weak, and that reporting is a stronger lever than click rate.

Measure reporting, not just clicks

A click rate tells you who made a mistake. A report rate tells you how quickly your organization can detect and respond to a real attack. One person reporting a phishing campaign within minutes can let the security team pull the message from every inbox.

The metrics I recommend tracking:

  • Report rate: percentage of recipients who report the simulation.
  • Time to first report: how quickly the first report arrives.
  • Click-and-report rate: people who clicked but then reported. This is a success, and it should be treated as one.
Person typing on a laptop at a desk, checking an email inbox for suspicious messages. Photo: Kit (formerly ConvertKit) / Unsplash
Person typing on a laptop at a desk, checking an email inbox for suspicious messages. Photo: Kit (formerly ConvertKit) / Unsplash

Design simulations that teach

Make the landing page practice, not punishment

Instead of a wall of text saying "You clicked a phishing link," show the email again with the clues highlighted, then give one quick scenario to try. Thirty seconds of active practice is worth more than three minutes of skimmed text.

Mirror real threats your people face

Generic "your package is delayed" emails are fine early on, but realistic simulations reflect real roles: invoice changes for finance, shared document lures for project teams, and fake MFA prompts or calls for IT. Verizon's 2026 report also highlights phone-based social engineering, so voice and SMS scenarios belong in the mix.

Make reporting effortless

One clearly labeled report button in the email client. A thank-you message every time someone reports, simulated or real. If reporting is hard, people won't do it.

Respect is a security control

The UK's National Cyber Security Centre has warned that phishing simulations used to blame or catch out staff can damage trust and make people less likely to report real incidents. Practical rules:

  • No public naming of people who clicked.
  • No punitive consequences for clicking a simulation.
  • Avoid lures that exploit real distress, such as fake bonus or layoff emails.
  • Tell employees that simulations happen and why.

Training is one layer, not the defense

Even well-trained people will click sometimes. Email filtering, phishing-resistant MFA like passkeys, and fast incident response are what limit the damage when they do. Awareness training works best as the layer that improves detection and reporting.

In the Cyber Shield Academy project, scenario-based practice and a strong reporting habit were central to the design. For the bigger program picture, see my post on building a security awareness program with NIST SP 800-50.

Sources

All Posts