3 September 2026LANTEK Computers
Security awareness training has a measurement problem. At the end of it you know who sat through it and, if there was a quiz, who could pick the right answer in a context where they knew they were being tested.
Neither of those tells you what happens at half past four on a Thursday when somebody is behind, a message arrives about an invoice, and it looks fine.
A simulation measures that. Which is its value, and also why it has to be handled carefully.
What it actually measures
A simulation sends a realistic but harmless message to your staff and records what happens. Three distinct outcomes, and they are not equally important.
Who opened it. The least useful number. Opening a message is not a failure; reading email is the job.
Who clicked. More meaningful. It means the message was convincing enough to act on.
Who entered credentials. The one that matters. This is the actual failure mode, because a password on a convincing page is the beginning of everything described in how business email compromise works.
And a fourth, which is the one most organisations forget to measure:
Who reported it. The most valuable metric on the page, and the one that should be going up. A business where somebody flags a suspicious message within minutes has an early warning system. A business where nobody reports anything is not safe, it is silent.
Why we are not giving you a benchmark
The obvious question after a first simulation is whether your result is good or bad, and there are widely quoted figures for what a typical click rate looks like.
We are not printing one. The circulating numbers are mostly repeated without a traceable primary source, they vary enormously with how hard the simulated message was, and comparing your result against somebody else’s average tells you almost nothing actionable.
What is genuinely informative is your own trend, measured with messages of comparable difficulty over time. Is the click rate falling. Is the reporting rate rising. Are the same people involved repeatedly. Those are answerable from your own data and they are the questions worth acting on.
Be alert to a provider quoting an industry average at you without a source, particularly one that makes your first result look alarming.
How to run it without damaging trust
This is the part that decides whether the exercise helps or backfires, and it is entirely about how it is framed.
Say it is coming. Not the date, not the content. But tell staff, in advance, that the business will periodically test with harmless simulated messages, that the purpose is to find out where the training is not landing, and that nobody is in trouble for clicking. A simulation sprung on people who were not told feels like entrapment, and the resentment costs more than the finding is worth.
Report aggregates to management, not names. Whoever runs it needs the individual data to target follow-up. What goes to the leadership is the numbers. The moment a list of names circulates, two things happen: people stop reporting anything, and the exercise becomes about blame.
Make the follow-up short and useful. Somebody who clicked gets a brief explanation of what the specific cues were in that specific message. Not a course. Two minutes, immediately, about the thing they just did.
Praise reporting loudly. Thank the person who flagged it, visibly. This is the single most effective behavioural lever available and it costs nothing.
Never use it in performance reviews. The fastest way to guarantee that nobody ever reports a real one.
Designing messages that teach something
A simulation that everybody spots teaches nothing. One that everybody falls for teaches only that it was unfair. The useful range is in between, and it should escalate.
Start with the generic: an unexpected notification, obvious enough that most people spot it, so the exercise starts with a success.
Then move to plausible: a message referencing something your business actually uses, arriving at a time it plausibly would.
Then, later and carefully, the realistic: internal-looking, referring to a real process, timed for a busy period. This is what real attacks look like, and it will catch capable people. That is the point, and it is also why the framing above has to be in place first.
Two things to avoid, both because they cause real harm rather than learning: never simulate anything about pay, bonuses or retrenchment, and never simulate anything about somebody’s family or health. Businesses have done both and the damage to trust considerably outlasts the exercise.
What a simulation does not fix
Being clear about the limits keeps expectations honest.
People will always click sometimes. The best trained workforce still has a bad Thursday, and a security posture that depends on nobody ever clicking is not a posture. The defence has to survive the click, which means multi-factor authentication so a captured password is insufficient, and monitoring so an unusual sign-in is noticed. Why MFA is not optional.
It also does nothing about the case where the message comes from a genuinely compromised supplier mailbox, which no cue would reveal. That one is stopped by the telephone verification rule for banking changes, not by awareness.
Frequency
Often enough that it is a habit, rarely enough that it is not noise. Quarterly suits most businesses. Monthly tends to produce fatigue and people who recognise the sender rather than the technique. Annually is not a programme, it is an event.
The question to ask a provider
Not what their catalogue of templates looks like. Ask: what do you report to management, what do you report to the individual, and do names go to anybody other than the person running it?
If names go to the leadership by default, the exercise will be about blame within two rounds, whatever anybody intends.
What we run is on Phishing Simulation, and how it sits in the wider picture on Cybersecurity. If you would like to know what is already exposed before testing anybody, the free dark web scan is the place to start.