Ask most businesses how their awareness programme is doing and they will quote a click rate. It is the wrong headline. A real phishing campaign against your finance team will get someone eventually. What determines the damage is how fast you find out.
The four numbers that matter
Report rate
What share of recipients flagged the message. This is the single best predictor of incident outcome, because a reported attack is a contained attack. A business with a twelve percent click rate and a sixty percent report rate is in far better shape than one with two percent and four percent.
Time to first report
Minutes from delivery to the first person raising it. This is the number that maps directly onto how much damage a real attack does, because it determines when you can start revoking sessions and blocking senders.
Repeat-click concentration
Whether risk is spread across the business or concentrated in a handful of people or roles. Concentrated risk is good news, because it is addressable with targeted support rather than a company-wide programme.
Trend, not snapshot
A single campaign tells you almost nothing. Difficulty varies, timing varies, and a bad month may just mean a harder lure. Quarter-on-quarter movement is the only reading worth putting in front of a board.
What to report to management
| Metric | What it answers | Good direction |
|---|---|---|
| Report rate | Would we find out? | Rising |
| Time to first report | How fast could we react? | Falling |
| Repeat clickers | Where is the risk concentrated? | Small and shrinking |
| Departmental split | Who needs targeted training? | Evening out |
| Training completion | Are we meeting our obligations? | At or near full |
| Click rate | How hard was the last lure? | Context only |
Why click rate misleads
Click rate belongs in the report as context, not as the headline. Presented alone it drives exactly the wrong behaviour, because the easiest way to improve it is to send easier simulations.
The metric nobody tracks and everybody should
Count genuine emails reported as suspicious. Most businesses treat these as noise. They are the clearest evidence your programme is working, because they show staff are willing to look cautious rather than risk being wrong. Discouraging over-reporting is how you quietly kill the behaviour you spent a year building.
Compliance evidence
If a standard or an insurer expects documented awareness training, the evidence usually needs to show recurring delivery and participation over a period rather than a single completed course. Build the record as you go, because assembling it retrospectively is far harder than capturing it at the time.
Reporting on awareness to your board?
We run awareness programmes and report on the numbers that actually predict incident outcomes, in a format non-technical directors can act on.
