Human risk management is replacing phishing click-rate proxies

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Phishing defence should move from click-rate proxies to continuous human risk scoring that measures real susceptibility, not just training completion.

Why it matters: IAM and security leaders need better evidence of human exposure because awareness programmes that track completion alone can leave social engineering risk materially unchanged.

Context

Phishing risk management is the problem space here, not a training refresh. The article argues that organisations have relied on completion rates and click rates as stand-ins for preparedness, even though those measures do not show whether people are actually less likely to fall for social engineering.

That matters for human IAM because the control objective is behavioural resilience, not course attendance. When phishing, business email compromise, and vendor fraud remain the most common paths into enterprise environments, teams need a way to measure susceptibility and target intervention where risk is highest.

Key questions

Q: How should security teams measure phishing risk beyond click rates?

A: Use layered behavioural signals instead of a single click metric. Track opens, credential submissions, replies, and tactic-specific susceptibility over time so you can segment risk by role and scenario. That gives security teams a more defensible basis for coaching, reporting, and board conversations than completion rates or one-off campaign results.

Q: Why do training completion rates fail as a phishing readiness measure?

A: Because completion measures administration, not resilience. A workforce can finish training and still remain highly vulnerable to realistic fraud, especially when attacks use trusted relationships and normal business context. Readiness should be measured by whether behaviour changes under simulation, not by whether a module was completed.

Q: What are the signs that phishing awareness is not reducing real risk?

A: The clearest signs are stable or rising susceptibility scores, repeat failures on realistic simulations, and little difference between people who completed training and those who did not. If the programme only produces attendance data and click rates, it is not showing whether the workforce is safer.

Q: How should teams measure employee susceptibility to business email compromise?

A: Use simulations that mirror actual workflow abuse, including manager, colleague, and vendor requests that look legitimate but create false urgency or financial pressure. Measure whether employees reply, comply, escalate, or challenge the request, then use those patterns to guide targeted coaching.

Technical breakdown

Why click-rate metrics fail as a risk signal

Click-rate measurement is a narrow simulation metric, not a reliable proxy for phishing resilience. It tells you whether someone interacted with one exercise, but not whether they recognised the pattern, escalated appropriately, or would resist a more realistic attack. When annual awareness programmes become compliance checks, the signal flattens into participation data. Behavioural risk management needs layered indicators because phishing susceptibility is distributed across people, roles, and attack styles.

Practical implication: stop treating campaign clicks as a readiness score and use them only as one weak signal in a broader behavioural model.

How layered phishing risk scoring changes measurement

Layered risk scoring combines multiple signals into a continuous view of susceptibility. The article points to opens, credential submissions on simulated landing pages, and exposure to specific attack tactics as examples of richer telemetry. That changes the control from one-time training completion to ongoing measurement of who is trending safer or riskier. For IAM and security teams, the technical shift is from campaign reporting to behavioural segmentation and targeted intervention.

Practical implication: build risk tiering that drives tailored coaching, follow-up, and prioritisation instead of one-size-fits-all re-training.

Why BEC and VEC simulations are a different test

Business email compromise and vendor email compromise do not depend on links or malware. They exploit trusted relationships, timing, and legitimate workflow context, which makes them closer to real fraud than generic phishing templates. Text-only simulations based on relationship data test whether people will reply, comply, or advance a request when the message looks procedurally normal. That is closer to the real social-engineering problem boards care about.

Practical implication: include relationship-based simulations in awareness programmes if you want to test fraud susceptibility, not just link-click behaviour.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Click-rate proxies are no longer sufficient for human risk governance. Completion tracking and simulation clicks were useful when the goal was programme coverage, but they do not measure whether employees are less exploitable. Human risk management has to answer a harder question: who is actually more or less likely to respond to a realistic lure. The implication is that security teams need to govern susceptibility as a living risk signal, not an annual training artefact.

Behavioural measurement is becoming the decisive control surface for phishing defence. The article's shift from binary outcomes to layered signals reflects where the market is heading. Boards want evidence of reduced exposure, not evidence of training administration. That makes continuous behavioural telemetry more valuable than campaign completion because it links awareness activity to risk posture.

Human risk management is now an identity governance problem, not just an awareness problem. Once phishing defence is measured through real behaviour, it sits alongside access governance, entitlement review, and privilege reduction as a control that must be monitored over time. The practitioner takeaway is that human susceptibility should be managed with the same discipline as any other identity risk posture.

Relationship-aware fraud simulations sharpen the boundary between social engineering and generic phishing. BEC and VEC attacks exploit trust in people, vendors, and workflow context, so the control test must mirror that reality. The relevant governance question is no longer whether a user clicks, but whether they recognise and challenge a legitimate-looking request that is operationally false.

Human risk scoring introduces a named concept: behavioural preparedness debt. Organisations accumulate this debt when they can report training completion but cannot show reduced susceptibility to realistic attack patterns. The concept captures the gap between administrative assurance and actual resilience, and practitioners should treat it as a measurable governance deficit.

From our research library:

• 74% of all breaches included the human element, through error, privilege misuse, stolen credentials or social engineering, according to Verizon's 2023 Data Breach Investigations Report.

What this signals

Human risk programmes will be judged less by training volume and more by whether they can demonstrate measurable improvement in susceptibility over time. That shifts attention from awareness administration to behaviour change, which is a stronger fit for IAM and security leaders who need evidence, not attendance records.

Behavioural preparedness debt: organisations build this gap when they can show completion data but cannot show that employees are less likely to fall for a realistic lure. The practical consequence is that phishing defence becomes a governance issue, because unmeasured susceptibility remains an open path into the enterprise.

Relationship-aware simulations are likely to become the more credible test because BEC and VEC attacks depend on trust, context, and workflow familiarity rather than obvious malicious indicators. Teams that still optimise for click rates will miss the fraud patterns boards care about most.

For practitioners

• Replace click-rate reporting with behavioural risk scoring Track opens, submissions, and tactic-specific susceptibility together so leaders can see whether risk is trending down across the workforce.
• Segment coaching by observed susceptibility Use risk tiers to target follow-up training and intervention only where the behavioural data shows higher exposure.
• Add relationship-based BEC and VEC simulations Test manager, colleague, and vendor scenarios that rely on context and trust rather than links or attachments.
• Measure preparedness as a continuous signal Report changes in susceptibility over time instead of relying on annual completion rates as proof of readiness.

Key takeaways

• Phishing defence is moving away from completion and click-rate proxies because those metrics do not prove that employee behaviour is safer.
• The more useful model combines layered signals and relationship-based simulations to show where real susceptibility persists.
• For identity and security teams, the operational task is to measure behavioural change continuously and direct coaching where risk remains highest.

Key terms

• Human Risk Management: The practice of managing how people interact with security controls, especially under pressure, distraction, or deception. It combines training, policy, and friction management so identity systems are still usable enough that users do not bypass them in day-to-day work.
• Phishing Risk Scoring: Phishing Risk Scoring is a behavioural measurement method that assigns risk based on how a person interacts with simulated or real phishing cues. It is more useful than click-rate reporting because it can combine opens, replies, credential submissions, and tactic-level susceptibility into one governance view.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Vendor Email Compromise: Vendor email compromise is a form of impersonation that targets supplier, contractor, or partner relationships. Attackers exploit routine vendor communication patterns to request payment changes, invoice redirection, or other sensitive actions, so identity and process verification must extend beyond internal users.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.