How do you know whether phishing defence is working?

Look for three signals: faster time from report to containment, fewer repeat exposures from the same campaign, and better quality of employee reporting over time. If the only numbers available are training completion or click rates, the programme is measuring participation, not control effectiveness.

Why This Matters for Security Teams

Phishing defence is only credible when it shows that suspicious messages are being absorbed, triaged, and contained before they become account takeover, malware delivery, or internal fraud. Training metrics can be useful for awareness, but they do not prove that the reporting path works under pressure or that responders can stop a live campaign quickly. The more reliable question is whether the organisation can detect, validate, and interrupt phishing activity before it spreads across mailboxes, identities, and downstream systems. That aligns with the measurement mindset in the NIST Cybersecurity Framework 2.0 and with NHIMG guidance in the Ultimate Guide to NHIs, where identity compromise is treated as an operational control failure, not just an awareness issue. When phishing defence is working, the organisation should see better signal quality over time, not just more course completions. In practice, many security teams discover the weakness only after a campaign has already been replayed across multiple users and the first reliable indicator is a post-incident review rather than a preventive metric.

How It Works in Practice

A working phishing defence programme measures outcomes across the full incident path, not just user behaviour in isolation. The most useful signals are operational: time from user report to analyst triage, time to containment, number of additional recipients exposed after the first report, and whether the same lure or sender is blocked on repeat. That is the practical equivalent of verifying that the control is interrupting the attack chain. NIST guidance on outcome-oriented security measurement supports this approach, and NHIMG’s Ultimate Guide to NHIs is relevant because phishing often becomes an identity problem once credentials, tokens, or session access are stolen.

• Track report-to-containment time by campaign, not just by incident ticket.
• Measure repeat exposure rate to see whether the same lure keeps reaching users.
• Review report quality, including whether users forward the full message, headers, and context.
• Correlate mail filter catches, analyst actions, and endpoint findings to identify where control gaps remain.
• Separate awareness metrics from response metrics so participation does not mask weak detection.

In mature programmes, reporting is easy, triage is fast, and blocking improves after each campaign because rules, detections, and user guidance are tuned from evidence. That also helps distinguish true phishing from business email compromise patterns that bypass simple filters. These controls tend to break down when reporting is fragmented across mail tools, service desks, and security operations because no single team can see the whole attack path in time.

Common Variations and Edge Cases

Tighter phishing controls often increase operational overhead, requiring organisations to balance faster containment against false positives, analyst workload, and user friction. Best practice is evolving on how much weight to give human reporting versus automated detection, especially in environments with heavy executive impersonation, multilingual lures, or supplier email traffic. A programme can look strong on paper but still fail if the organisation has high reporting volume without fast validation, because flood conditions hide the messages that matter. Guidance from the NIST Cybersecurity Framework 2.0 is most useful here: judge whether controls reduce business impact, not whether they simply create activity. For identity-heavy environments, the question is also whether phishing leads to compromised access, which is why NHIMG’s research on the scale and persistence of identity exposure matters. In practice, the hardest edge case is when a campaign is stopped at the mail gateway but the same social engineering reappears through collaboration tools, SMS, or direct-message channels because the measurement model only covers email.

Related resources from NHI Mgmt Group

• How do IAM teams know whether behavioural detection is working for identity abuse?
• How do teams know whether their email security controls are keeping up with AI phishing?
• How do security teams know whether Teams remediation is working?
• How do you know whether federal ICAM offboarding is actually working?