# Best Practices to Manage and Reduce Phishing Risk

How to measure the spread of phishing risk across employees, benchmark click rates against tests of similar difficulty, and manage your highest-risk employees.

Author: [Masha Sedova](https://www.ians.com/faculty/masha-sedova) 5 min read November 7, 2023 Updated October 16, 2026

Key points

- Measure how phishing risk is spread across employees, not just the average click rate, and work to shrink the share of employees in the high- and medium-risk groups.
- Grade each simulated phishing email by how hard it is to spot, and compare results with tests of similar difficulty so you measure real progress.
- Look beyond simulation clicks. Track which employees attackers target, who falls for real phishing attacks, and what other safeguards protect each person.
- Don’t count on training alone. A 2025 study of more than 19,500 employees found it barely cut clicks, and its authors suggested physical security keys and password managers may work better.

Phishing resilience is hard to measure, and most platforms focus on momentary measurement of a campaign in terms of employee success or failure. To more accurately gauge an organization’s ability to handle phishing attacks, use metrics that demonstrate employee risk type changes over time and identify risk distribution.

## What Does a Typical Phishing Simulation Program Include?

Masha: Running phishing simulations has been a best practice in security for the last 10 years. Today a typical phishing program will send out between 4-12 phishing emails a year to employees. Upon clicking a link, employees are directed to a training. A phishing button is often provided as a reporting vehicle for both simulated and actual phishing attacks. More advanced options of these programs include:

- Segmenting the population to receive different templates or staggering send times
- Adjusting templates to regional languages
- Grading templates on difficulty levels
- Rewarding positive behaviors and awareness
- Escalating conversations with repeat offenders
- Terminating individuals with more than three clicking violations

As organizations come to the realization that click-through rates will never get to 0%, inevitably the question arises of ‘what is good enough?’. Do organizations need more phishing tests or less? Have better training? Impose restrictions on ‘guilty’ individuals?

## Can Phishing Simulations Alone Reduce Phishing Incidents?

Ultimately, these are all the wrong questions because the problem we are trying to solve can’t be fixed with just simulated phishing. Let’s remember the problem we are trying to solve: Reduce the number of user-generated phishing incidents that occur in our organizations. I can count on one hand the number of organizations that tracked phishing incidents reduction as a metric of simulated phishing programs.

In order to effectively tackle this problem, we need broader insights other than simulated phishing clicks. This includes insights into who is being targeted by attackers, who falls for actual phishing attacks, what compensating controls someone has, and finally how much ‘security common sense’ they have when it comes to phishing.

## How Do You Identify Employees at Highest Risk of Phishing?

Repeated research studies have shown that employees will consistently fall into 3 types of phishing risk: high, medium, and low - click rates based on the average times they click during simulated phishing tests.

When considering risk it’s not about the average employee click rate: it’s about the distribution of risk. What percentage of your employees are high risk? An effective program is all about [managing and reducing the risk](https://www.ians.com/professional-development/security-academy/courses/measuring-and-managing-human-risk) from your highest-risk employees.

## How Do Security Teams Measure Phishing Risk?

Masha: Common metrics for programs today boil down to two numbers: average click rate and average reporting rate for an organization. These are regularly updated as new phishing tests are rolled out with the hope that clicks will decrease to 0% and reporting rates will skyrocket.

Occasionally, click rate metrics are expanded into greater detail to include factors such as percentage of employees who: submitted credentials, downloaded attachments, or are repeat offenders.

However, there are two gaps in these metrics that organizations should consider when measuring their programs.

- **Benchmarking Tests:**
  - One common gap is the lack of graded templates in terms of difficulty, making it challenging to measure progress against similar tests.
  - Current phishing programs vary in terms of template difficulty, with some being easy to detect (low click rates) while others are more challenging (high click rates).
  - Practitioners should establish a phishing difficulty rubric and grade each template prior to sending. Results should be compared against similarly difficult tests.
- **Risk Distribution. Not average Rates:**
  - Programs should determine what qualifies as low, medium, and high-risk phishing behaviors for the organization.
  - Next, determine what percentage of employees fall into each category.
  - Work to remediate the high and medium categories, while retaining good behavior in low-risk individuals.

![bar graph showing the improvement in employee risk after implementing a phishing program](https://www.ians.com/_astro/best-practices-to-manage-and-reduce-phishing-risk-figure-1.Wbx2KS4h_2kvII9.webp)

## How Do You Benchmark a Phishing Click Rate?

If your organization must benchmark against a single ‘click rate’, and it will never get to 0%, how do you determine what is an acceptable floor? What is a “good” click rate? There are a few options.

- **Option 1: Vendor benchmarking.** The most popular option - but buyer beware! Understand how the report was created and what data sets were used. What phishing difficulties were used? What maturity of companies were benchmarked?
- **Option 2: Industry-wide metrics.** The Verizon Data Breach Investigations Report publishes median click rates from phishing simulation campaigns. Use this annual report to compare yourself with peers.
- **Option 3: Compare your progress over time.** Establish an average click rate for easy tests. Once it gets sub-10%, increase difficulty of the tests and repeat training/interventions until click rates go down once again.

## How Many Phishing Simulations Are Enough?

Masha: Enough is a function of the goals of a phishing program. Given that 0% is not possible, here are best practice suggestions:

- Run enough phishing tests to figure out which risk grouping (High, Med, Low) an employee fits in. Run appropriate interventions for employees in that group.
- Run tests that are benchmarked against your previous test to track trends. You are looking to reduce the percentage of the population in your high and medium risk groups.

Research data indicates that after seven phishing tests, there’s a plateau in risk reduction. This means that conducting more than seven tests might not provide significant incremental value in terms of improving employee behavior. After about a year of simulations or 7-11 phishing tests, results stabilize (we see about a 5% click through rate ongoing).

## How Do You Reduce Phishing Risk From High-Risk Employees?

It’s not just about how many tests there are but also about considering the types of interventions. Beyond standard tests, strategies like phishing-resistant MFA, password manager use, and reducing MFA timeout can be more effective in managing and moving high risk employees to a lower risk group.

### What changed: A 2025 study found most employees click eventually, trained or not

A study of more than 19,500 employees at a large healthcare organization, presented in May 2025, found no link between recent annual awareness training and failing a phishing simulation. Training shown right after a click lowered failure rates by about 1.7 percentage points on average, and over half of those training sessions ended within 10 seconds. Over the study’s eight months, more than half of employees clicked at least one simulated phish, and avoiding earlier simulations did not reliably predict avoiding later ones. The authors concluded that technical countermeasures may offer a better return on investment, such as hardware MFA and password managers that fill in credentials only on the correct domain.

Source: Understanding the Efficacy of Phishing Training in Practice, an IEEE Symposium on Security and Privacy 2025 paper from [UC San Diego](https://sysnet.ucsd.edu/~voelker/pubs/phishtrain-oakland25.pdf)

Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our News & blog posts, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by individuals or firms in connection with such information, opinions, or advice.

Share this article

About the author

[![Headshot of Masha Sedova](https://www.ians.com/_astro/masha-sedova.CW_sZO5O_1vKWgF.webp)](https://www.ians.com/faculty/masha-sedova)

## [Masha Sedova](https://www.ians.com/faculty/masha-sedova)

IANS Faculty

Masha Sedova, co-founder of Elevate Security, has made her mark in cybersecurity through her practical and human-centered approach to the field. Under her leadership, Elevate Security’s innovative platform significantly reduced user-related risks for Enterprises. This led to its acquisition by Mimecast in 2024 where she now serves as VP of Human Risk Strategy. Honored by Fast Company in 2021 for her creativity in business, she previously honed her expertise at Salesforce, where she pioneered engaging security awareness initiatives through gamification, thereby redefining industry standards. A top rated speaker at Black Hat and RSA, she also supports tech inclusivity as a CompTIA Spark board member.

[View full profile](https://www.ians.com/faculty/masha-sedova)

## Frequently asked questions

What is a good phishing reporting rate?

So if you hit below 25% or so on phishing reporting, either your phishes are too good or your users are too jaded to get decent reporting handled. You have a problem either way. If a phish is so good that your users aren’t seeing it as one, then you need better technical controls anyway. If you’re over maybe 70-75%, you’re possibly making it too easy or your incentives for reporting are gamified too hard.Source: Defining a ‘Good’ Phishing Report Rate, an IANS [Ask-An-Expert](https://www.ians.com/ians-intelligence/ask-an-expert) faculty poll, answer by [Tarah Wheeler](https://www.ians.com/faculty/tarah-wheeler)

How do you improve employee phishing reporting rates?

Break your organization down into meaningful units, such as departments, and report the results that way, creating an internal competition as to who is leading on reporting phishing. Do interviews with those who are reporting, as well as those who are not reporting, to find out what is driving their behavior. Find examples where real phishing messages were reported and how it prevented a cyber incident. Write stories or tell stories about them.Source: Increase Employee Engagement in Phishing Reporting, an IANS [Ask-An-Expert](https://www.ians.com/ians-intelligence/ask-an-expert) faculty poll, answer by [Meg Anderson](https://www.ians.com/faculty/meg-anderson)

How should you handle departments that keep failing phishing simulations?

Good practice is to evaluate if there are certain groups that are predisposed to repeat clicking. For example, customer service reps have high click rates. You can work with their managers and business lines on training. Gaining support from business line managers is crucial for success.Source: Re-Engineer Phishing Training for Repeat Clickers, an IANS [Ask-An-Expert](https://www.ians.com/ians-intelligence/ask-an-expert) faculty poll, answer by [Holly Ridgeway](https://www.ians.com/faculty/holly-ridgeway)

Vendor evaluations

Peer benchmark data

Expert answers

Compliance mapping

Program guidance

Threat intelligence

Templates & tools

Technical deep dives

Emerging tech signals

IANSMCP

Claude

Copilot

![ChatGPT](https://www.ians.com/icons/llms/chat-gpt-logo.svg)

Coming soon

Everything the IANS MCP server draws on

- Vendor evaluations
- Peer benchmark data
- Expert answers
- Compliance mapping
- Program guidance
- Threat intelligence
- Templates & tools
- Technical deep dives
- Emerging tech signals

[Explore IANS MCP](https://www.ians.com/mcp-server)

## Still have questions? Ask IANS in your AI tool

IANS MCP brings practitioner- and peer-validated security intelligence into every AI answer, cited and delivered right to the AI tool you already use.

[Explore IANS MCP](https://www.ians.com/mcp-server)

## Still have questions? Ask IANS in your AI tool

IANS MCP brings practitioner- and peer-validated security intelligence into every AI answer, cited and delivered right to the AI tool you already use.

[Explore IANS MCP](https://www.ians.com/mcp-server)

## Further Reading

[Browse all articles](https://www.ians.com/blog)

[How to Track Phishing Resilience Using a Metrics Matrix How to build a phishing metrics matrix that tracks trends over time instead of single-point campaign results. Mar 10, 20225 min read Ian Amit Mar 10, 20225 min read Read more](https://www.ians.com/blog/ians-research/how-to-track-phishing-resilience-using-a-metrics-matrix) [How to Deal with Individuals Who Repeatedly Fail Phishing Simulations Why employees keep failing phishing tests: 6% of users caused over 29% of failures. Fixes: a four-strikes rule, root-cause analysis, rewards, and gamification. May 22, 20257 min read Summer Craze Fowler May 22, 20257 min read Read more](https://www.ians.com/blog/ians-research/how-to-deal-with-individuals-who-repeatedly-fail-phishing-simulations) [How to Implement Effective Anti-Phishing Solutions Why successful anti-phishing programs focus on culture and real-world simulations rather than click rate alone. Feb 2, 20217 min read Mike Saurbaugh Feb 2, 20217 min read Read more](https://www.ians.com/blog/ians-research/how-to-create-an-effective-anti-phishing-program)