Advanced phishing simulation shows why click rates are not enough

At a glance

What this is: This is an analysis of enterprise phishing simulation, with the central finding that click rates alone are too narrow to represent real human risk.

Why it matters: It matters because IAM, security operations, and human risk teams need simulations that reflect identity context, behavioural patterns, and modern attack paths rather than simple awareness scores.

Context

Basic phishing simulation measures one observable action, but modern attacks are multi-step, role-aware, and often delivered through more than one channel. That means a clean click rate can hide weak controls around user privilege, MFA handling, and identity-linked risk.

In enterprise environments, the governance problem is not whether employees can spot a generic template. It is whether simulation design can reflect realistic targeting, access context, and threat progression well enough to drive meaningful training and response.

Where phishing results are disconnected from identity and threat telemetry, security teams get a training metric instead of a risk signal. That gap is especially relevant for programmes that need to prioritise high-value users and reduce attack exposure across human identity workflows.

Key questions

Q: How should security teams measure phishing risk beyond click rates?

A: Use layered behavioural signals instead of a single click metric. Track opens, credential submissions, replies, and tactic-specific susceptibility over time so you can segment risk by role and scenario. That gives security teams a more defensible basis for coaching, reporting, and board conversations than completion rates or one-off campaign results.

Q: Why do multi-vector phishing simulations reveal more risk than generic tests?

A: Because attackers rarely rely on one message alone. Multi-vector simulations test whether people can recognise coordinated pressure across channels, follow-up messages, and authentication prompts, which is a much closer approximation of how real phishing works in enterprise environments.

Q: What are the signs that a phishing simulation programme is too shallow?

A: The programme is probably too shallow if it only reports click and report rates, uses repeated templates, ignores privileged users, and cannot show how identity or threat data changes the interpretation of results. Those are signs the exercise is measuring compliance behaviour rather than resilience.

Q: How can human risk programmes support identity governance?

A: They support identity governance when simulation results help decide who needs closer monitoring, additional training, or access-aware intervention. The goal is to connect behaviour to role and privilege so security teams can reduce exposure instead of simply counting mistakes.

Technical breakdown

Why click rates understate phishing risk

Click rate is a narrow behavioural metric. It records whether a user interacted with a lure, but it does not show whether the simulation resembled the attack path that matters in production, such as a spear-phishing follow-up, smishing, QR code abuse, or a credential collection flow aimed at a privileged role. In practice, the quality of the scenario matters more than the raw percentage. A poor simulation can make an organisation look safer than it is because the test never exercised the kind of decision pressure real attackers use.

Practical implication: Measure simulation realism and user context, not only response percentages.

How multi-vector phishing changes the control problem

Multi-vector phishing combines email with SMS, phone, QR codes, or follow-on lures to build trust across channels. That changes the control problem from a single inbox check to a broader trust decision spanning message provenance, user behaviour, and authentication handling. When simulations include MFA bypass attempts or QR-based delivery, they test whether employees can recognise chained deception rather than just a suspicious sender. This is closer to how modern attackers operate and gives defenders a better view of where human and process controls actually fail.

Practical implication: Design simulations that exercise cross-channel trust and authentication decisions.

Why identity and threat data must inform simulation design

Advanced phishing simulation becomes more useful when it is correlated with identity, access, and threat intelligence data. Behaviour alone does not tell you whether a click is materially risky; a user with access to sensitive systems or active targeting from a known campaign has a different risk profile from a low-risk user. The identity context lets security teams prioritise, personalise, and sequence interventions. Without that layer, training is often generic and untargeted, which limits its value for enterprise risk reduction.

Practical implication: Use identity and threat context to target training and prioritise higher-risk users.

Threat narrative

Attacker objective: The attacker wants to turn human trust into account access, credential capture, or an initial foothold for broader compromise.

1. Entry begins with a phishing lure that is more credible than a generic email because it may be delivered through multiple channels such as email, SMS, or QR code.
2. Credential access or user compromise follows when the target enters information, follows the lure, or accepts a secondary authentication step under pressure.
3. Impact occurs when the attacker uses that trust breach to reach accounts, systems, or data that were never meant to be exposed through a single click event.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Click-rate-only testing is an incomplete control model: it measures interaction, not exposure, and it therefore misses the real question of whether a user was placed into a believable attack path. In modern phishing, the attacker optimises for context, timing, and follow-on trust, so the control has to evaluate scenario fidelity as well as user response. Practitioners should treat click rate as a weak proxy, not a security outcome.

Human risk becomes materially different once identity context is added: a failed simulation on a privileged user means more than a failed simulation on a low-access user. Behavioural data only becomes actionable when it is tied to access scope, role criticality, and threat telemetry. That is where human risk management stops being awareness reporting and starts supporting prioritisation.

Multi-vector delivery exposes a training gap that traditional programmes ignore: attacks increasingly use coordinated messages, QR codes, smishing, and MFA pressure because a single luring surface is easier to recognise than a sequence. This creates a named governance gap we can call scenario realism drift: simulation programmes drift away from the attack conditions they are meant to represent, so measured resilience rises while actual resilience does not. Practitioners should correct for that drift by aligning simulation scenarios to current threat patterns.

Phishing simulation is now an identity-adjacent governance problem: the moment results are used to target training, rank risk, or decide who needs additional monitoring, they become part of identity governance. That means human risk programmes should be reviewed alongside IAM, access policy, and privileged-user controls, not treated as a standalone awareness activity. The conclusion for practitioners is simple: if simulation data cannot inform access-aware action, it is not mature enough to guide enterprise defence.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Scenario realism drift: phishing programmes often drift toward reusable templates and away from the attack conditions employees actually face. When that happens, reported awareness improves faster than operational resilience, so the programme must be reset around current delivery channels, privilege context, and user role.

For identity and access teams, the practical shift is to treat simulation telemetry as a governance input, not a standalone awareness metric. That means risk-ranked users, adaptive training, and exposure reduction actions should be derived from the same evidence set, especially where privileged access or high-value accounts are involved.

For practitioners

• Replace generic templates with scenario-based simulations Build campaigns that reflect current attack patterns, including spear phishing, smishing, QR code abuse, and MFA pressure, so the exercise tests real decision paths instead of recognition of an obvious fake.
• Correlate simulation outcomes with identity data Join phishing results to role, privilege, and access tier so high-impact users receive different treatment from low-risk users and the programme can prioritise where failure matters most.
• Trigger immediate adaptive training from risky actions Use the moment of failure to launch short, targeted remediation content rather than waiting for a quarterly awareness cycle, and track whether the same user pattern repeats across campaigns.
• Test deliverability before judging the campaign Confirm that secure email gateways, spam filters, and allow-listing rules are not preventing simulations from reaching inboxes, otherwise the metrics only measure mail control friction.

Key takeaways

• Generic phishing tests can overstate resilience because they measure a narrow interaction instead of the full trust path an attacker uses.
• The more realistic the simulation, the more useful it becomes for identifying risky behaviour in high-value roles and accounts.
• Programmes that connect simulation results to identity and threat context can move from awareness reporting to targeted risk reduction.

Key terms

• Phishing Simulation Workflow: A phishing simulation workflow is the process used to convert a real or representative attack message into safe training content. It preserves the lure mechanics that make the message believable while removing malicious payloads, sensitive data, and operational risk before delivery to employees.
• Human Risk Management: The practice of managing how people interact with security controls, especially under pressure, distraction, or deception. It combines training, policy, and friction management so identity systems are still usable enough that users do not bypass them in day-to-day work.
• Multi-Vector Phishing: A phishing campaign that combines more than one communication path, such as email, SMS, QR codes, or voice, to increase credibility and pressure. The technique is harder to detect because the attacker builds trust across channels instead of relying on a single lure.
• MFA Bypass: MFA bypass is any technique that defeats the protection offered by multi-factor authentication without actually breaking the control itself. This includes prompt abuse, token theft, adversary-in-the-middle attacks, and weak reset or enrolment processes that let an attacker re-establish trust.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the course if your programme needs stronger grounding in identity-led security decisions.