Phishing Tests: How to Talk With the People Who Clicked

A phishing test is a controlled, harmless version of the attack your team already faces: an email built to look convincing, sent with the owner's authorization to the people on the team, with a safe page behind the link instead of a real one. It records who clicked, who ignored it and, when the company has a way to report, who raised a hand. The report usually lands within a few days. What it does not do is tell you what to say next. That is the part that decides whether the test made the business safer or just produced a number.

Here is the three-step plan:

• First days. Read the numbers, then talk with the people who clicked, one at a time and in private. Thank the people who reported, and do it in public.
• Within a week. Give everyone a place to report suspicious email. Turn on multi-factor authentication wherever it is still off. Tell the team that tests happen and will continue.
• Never. Publish the list, punish a click, or treat the result as a grade.

The numbers come first, because the conversation goes better when you know what they mean. The rest of the page is the conversation itself, what not to do, and the three changes that make the next one shorter.

What the numbers mean

Most reports open with two rates. The open rate is how many people opened the email, and it is the least reliable number on the page: mail clients block tracking images, preview panes count as opens, and security scanners open everything. Treat it as context, not a result. The click rate is how many people followed the link or opened the attachment, and it is the number every tool leads with. Many vendors roll clicks and other interactions into one figure called the Phish-Prone Percentage (PPP), also known as the failure rate: the percentage of recipients who interact with a simulated phishing email, such as clicking a link or opening an attachment. Some tests go one step further and count who typed a password into the fake page. In most tests the page behind the link collects nothing, so a click is a signal, not a breach.

Clicks will never reach zero. A well-built lure exists to be clicked, and the people who build them for a living are good at it. That is why some companies also track a third number, the report rate: how many people, instead of clicking or quietly deleting, told someone. If your report has it, it is the number that tells you whether your business is safer. A team that reports gives you the minutes you need to warn everyone else, freeze a payment, or reset a password before the real damage. "Ignored" feels safe, but it is silent, and silence is what an attacker needs.

Read the numbers against the email, not only against the people. A good report includes the email that was sent, annotated with the tells that were there. If the lure matched the work, it was hard by design: a "customer dispute" with an attachment, sent to the person who handles refunds all day, is an email that person's job requires them to open. NIST built a whole method around this, the Phish Scale, and its central finding is that when a message fits someone's work, they attend to the cues that fit and discount the ones that don't. A click on a hard email says the email was good. It does not say the person is careless.

Then the question everyone asks: is three out of ten bad? It is ordinary. The largest public dataset, KnowBe4's 2026 benchmarking report, measures exactly that Phish-Prone Percentage. It puts a first test at roughly a third of recipients, and shows what happens under a sustained program:

The report's own line is that "the most significant behavioral change happens between month three and month twelve." Your first number is a baseline. What you do in the next week decides whether it is also the peak.

How to talk with the people who clicked

One at a time, in private. Not a reply-all, not a slide in the Monday meeting. A short conversation or a direct message from someone they trust.

Lead with the email, not the person. Open the email together, with the report's notes beside it, and point at the tell: the sender's real address, the link that didn't go where it said, the pressure to act now. The message you want to land is "this one was built to be clicked, and here's the thing that gives it away", not "you failed".

Ask what the moment looked like. Most clicks happen in a particular minute: on the phone, between two customer messages, expecting exactly that invoice. Asking is not an interrogation. It tells you which lures fit your team's work, which is what the next test needs to know, and it turns the talk from a verdict into a debrief.

Say what would have happened for real, in one sentence. For a store: "a real version of this puts someone inside the mailbox that talks to our customers, or in front of the panel where refunds are approved."

Give them the next move, and make it safe. Two rules, both simple. When an email feels off, report it instead of deleting it. And if you clicked, say so right away, because a click is recoverable in minutes and expensive in hours. The person who admits a click the same morning did the second-best thing available. Make sure they know it.

Something like this works, in chat or in person:

Hi Ana. That "chargeback dispute" email on Tuesday was a test we ran, and you were one of the people who clicked. No harm done, the page was harmless. I wanted to show you the two things that gave it away, because the real ones look exactly like this. And whatever happens next time, click or not, just tell me. Fast beats perfect.

The people who reported are the ones you name. Thank them by name, in front of others. That is the single place in this whole exercise where a name belongs in public, because you are showing everyone the behavior you want copied.

The people who ignored it are the majority. Tell them the same thing you told the clickers: next time, report it. An ignored phish protects one inbox. A reported one protects the company.

What not to do

Don't name and shame. The click list is not a leaderboard. In December 2020, GoDaddy sent employees a test email promising a holiday bonus, then told the hundreds who clicked that they had failed and would retake training; the company apologized publicly. Three months earlier, Tribune Publishing had run a test dangling bonuses during a year of furloughs and pay cuts, and called it, in its own apology, "misleading and insensitive". Both stories carry two lessons. The lure crossed a line, which is why a well-run test stays away from pay, layoffs and health. And the follow-up treated a click as a personal failing, which is what people remember years later, long after they have forgotten the tell.

Don't count on the training page. The industry habit is to send whoever clicks straight to a lesson. The two largest independent studies of that habit both found it does little. ETH Zurich watched more than 14,000 employees for fifteen months and concluded that embedded training "does not make employees more resilient to phishing", and can have side effects that make things worse. UC San Diego Health ran a randomized trial with 19,500 staff over eight months: the training page cut failures by about two percentage points, three quarters of the people who saw it spent under a minute on it, and the annual awareness course made no measurable difference at all. The lesson is not that people can't learn. It is that they learn from the conversation above and from the changes below, not from a page they close in seconds.

Don't punish. A penalty teaches exactly one thing: hide the click. That is the only outcome worse than the click, because everything that limits the damage of a real one depends on hearing about it in minutes.

Don't circulate the list. Per-person results are personal data about your employees, under the LGPD in Brazil and the GDPR in Europe, and under your own employment policies everywhere. A test report should go to the person who authorized it and to no one else. Keep it that way: the owner, the person's manager, and whoever runs IT. It is not a document for HR files or performance reviews.

Don't announce the next one. Tell the team that tests happen and will continue. Never say when.

The three changes that move the number

As the security team you don't have to hire, this is what we'd change in the week after a first test, in order.

1. Give people a place to report, and answer it. A "report phishing" button in Outlook or Gmail, or simply an address the whole team knows, watched by someone who replies. The reply matters: a report that vanishes into silence is the last one that person sends. The ETH Zurich study's other finding was that this works at scale: employees report quickly and accurately enough to act as the company's detection system. It is also the only measure on this page that catches the real attack you don't know about yet.

2. Make a click survivable. The UC San Diego authors ended their paper by pointing away from training and toward technical controls, above all two-factor authentication and "password managers that only work on correct domains". We agree. With multi-factor authentication on, a password typed into a fake login page is a bad afternoon. Without it, it is a takeover. If the lure was an invoice or a change of bank details, add the payment habit from our piece on CEO fraud: every new payee confirmed by a call to a number you already had.

3. Test again, and keep testing. One test is a photograph. The number only moves under a program: a different lure every time, a different channel now and then, and a report rate you watch climb. That is where the benchmark's month three to month twelve comes from. If this was your first, the second is where the number starts moving. If you haven't run one yet, start with a free phishing test for employees, and come back to this page the day the report lands.

Frequently asked questions

Should I tell the team a test is coming? Tell them that tests happen, in the policy they already sign and in a sentence from you. Don't tell them when. A warned test measures memory. An unannounced one measures the reflex.

Is a click rate of one in three bad? It is typical for a first test without prior training. What would be bad is the same number on the fourth test.

What if I clicked? Say so, to the team. The owner admitting a click is the fastest way to make it safe for everyone else to admit one, and that admission is what saves you in a real attack.

Does AI make phishing tests pointless? The opposite. Everything we've written this year about AI-run attacks ends at the same door: the one person who said no. AI removed the spelling mistakes and the clumsy grammar we were all taught to look for, so the surface tells are gone. The reflex to pause and report is what's left, and a test is the only way to measure it.

How often should we test? Quarterly is the floor. Continuous programs, with a small campaign every few weeks, are where the numbers above come from, and they stop the team from "remembering the test" the way an annual one invites.

For your IT team. Route reports to a mailbox a human reads, enforce MFA with number matching, move to passkeys where the platform allows. Finish SPF, DKIM and DMARC so the exact-domain spoof can't land. Write the "I clicked" runbook now: revoke sessions, reset the password, check mailbox rules and forwarding, review recent sign-ins. We keep the technical version for whoever owns that side of your stack. See what we'd check →

---

The report is the start of a program, not the end of a test. If you'd rather have the security team you don't have to hire run the next twelve months, talk to us.