Phishing simulations are useless without the follow-up conversation

Run a phishing simulation and you get a number: the percentage of staff who clicked. Put it on a slide next to last quarter's number and you have a chart that trends down. The chart is real. The security improvement it implies mostly is not.

What reduces risk is not the test. It is the ten minutes after someone clicks, and almost no program spends them well.

The click is a teaching moment or it is nothing

When someone fails a simulation, the default response is an automated redirect to a training video. The video is skipped, the tab is closed, and nothing about that person's behaviour changes. A short, human, non-punitive conversation does more than any module:

• Show them the exact signal they missed, like the mismatched sender domain, the urgency, the unusual request.
• Ask what they were doing when it arrived. Busy people click; the fix is often workflow, not awareness.
• Tell them precisely what to do next time, and make that action one click.

A click rate measures the test. A report rate measures whether your people are actually watching.

Measure reporting, not just clicking

The metric that predicts real-world resilience is how many people report the simulated phish, and how fast. A team where 40% click but 50% report is in far better shape than one where 10% click and nobody reports, because in the real incident the reporters are your early-warning system. Make the report button one click in the email client, thank every person who uses it, and watch the number climb.

Never make it punitive

The fastest way to kill a reporting culture is to punish clicks. Punished people stop reporting their own mistakes, which is the exact behaviour you cannot afford in a genuine breach. Keep simulations blameless, keep the follow-up a conversation rather than a mark on a record, and the program starts changing behaviour instead of just producing a chart.