What counts as a good click rate in your phishing simulation? Is it 10%, 6%, or maybe 3%?

There is excessive focus on a single number without considering the context — who clicked, their level of access, and much more. It should be aligned with risk.


- How many were tricked.
- The number of high-access individuals who were tricked.
- Impacted departments, considering their risk level and function.
- The count of people who reported.
- The number of individuals who were tricked and didn’t report.


We can utilize simulations to obtain insightful feedback to customize cybersecurity …

access click context cybersecurity focus good high phishing phishing simulation rate risk simulation single