A simulation programme that always sends easy lures produces flattering numbers and teaches nothing. Recording difficulty alongside results is what makes the trend meaningful rather than a function of how gentle you were feeling.
Record difficulty with every campaign. A falling click rate means nothing if the lures got easier. Rate each campaign from obvious to highly targeted, and compare like with like over time.
Always record report rate alongside clicks. The report rate is the number that correlates with real-world detection. A campaign with 8% clicks and 45% reports is a better outcome than 3% clicks and 5% reports.
Support repeat clickers rather than listing them. Someone clicking repeatedly usually has a role that makes them a legitimate target, or is simply very busy. A short conversation achieves far more than appearing on a leaderboard.
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
Difficulty is the column that makes the trend interpretable.
| Date | Campaign theme | Audience | Difficulty | Sent | Clicked | Click % | Reported | Report % | Credentials entered |
|---|---|---|---|---|---|---|---|---|---|
| 2026-01-14 | Package delivery notification | All staff | Easy | 162 | 19 | 11.7% | 22 | 13.6% | 4 |
| 2026-04-09 | Internal IT password expiry | All staff | Medium | 164 | 14 | 8.5% | 51 | 31.1% | 2 |
More free templates IT teams use alongside this one.
Annual click-through training produces a completion certificate and no behaviour change. A programme that works is short, frequent, role-specific, and measured against behaviour rather than against attendance.
Security incident response plans are usually written for an auditor and discovered to be unusable during the first real incident. The sections that matter are the ones you read in the first hour: who decides, who to call, and what not to touch.
DMARC enforcement is straightforward to configure and easy to get wrong in a way that silently drops legitimate mail. The whole method is to inventory your senders first and move the policy in stages while watching reports.
Quarterly for the whole organisation, with targeted campaigns for high-risk roles in between. Monthly simulations for everyone tend to produce fatigue and gaming, where people report anything unusual without reading it.
It depends entirely on lure difficulty, which is why difficulty must be recorded. A single-digit rate on an easy lure means little; the same rate on a well-crafted targeted lure is genuinely good. Trend against comparable difficulty.
Because reporting is what gives the security team warning of a live campaign. A workforce that clicks occasionally but reports within minutes is more defensible than one that rarely clicks and never tells anyone when something looks wrong.
