TL;DR: Phishing simulation software is moving from click-rate testing to predictive human risk management, with Living Security Human Risk Management Platform arguing that behavioral data becomes more useful when correlated with identity, access, and threat signals. That shift matters because phishing programmes only reduce risk when they change behaviour, not when they simply score failure.
At a glance
What this is: This is a guide to phishing simulation software that argues the real value is no longer simple click-rate measurement but predictive human risk management grounded in behavioral, identity, and threat data.
Why it matters: It matters because IAM, security awareness, and HRM teams need metrics that identify who is likely to be targeted or make risky decisions before a phish turns into credential abuse or account compromise.
Context
Phishing simulations are often treated as a post-event awareness check, but that model breaks down when the goal is to reduce risk before credentials are entered or links are clicked. The article’s core premise is that behavioral testing becomes more useful when it is connected to identity and access context, because click rates alone do not explain exposure, privilege, or likely impact.
That matters to identity and security programmes because human behaviour does not sit outside the control stack. If simulation results can be correlated with access level, reporting behavior, and threat exposure, then the programme moves from generic training toward targeted governance of risky user paths. For teams running IAM, PAM, and awareness programmes, that is a change in control design, not just reporting.
Key questions
Q: How should security teams measure phishing risk beyond click rates?
A: Use layered behavioural signals instead of a single click metric. Track opens, credential submissions, replies, and tactic-specific susceptibility over time so you can segment risk by role and scenario. That gives security teams a more defensible basis for coaching, reporting, and board conversations than completion rates or one-off campaign results.
Q: Why do AI evaluations need identity and access context?
A: Because many AI failures happen through who can retrieve, prompt, or act on data, not just through model quality. If evaluations ignore permissions, connectors, and retrieval paths, they miss the mechanisms that let sensitive information surface in production. Identity context makes the evidence operational.
Q: What are the signs that phishing awareness training is not working well enough?
A: Training is failing when employees still click, reply, or escalate suspicious messages without checking basic details first. Other warning signs include repeated responses to urgent language, weak reporting rates, and inconsistent use of verification steps for unexpected links or attachments. If people can describe threats but do not change behavior, the program is informative but not operationally effective.
Q: How can teams keep phishing simulations from harming trust?
A: Be transparent about the existence of simulations, explain their educational purpose, and avoid public shaming or performance punishment. Employees are more likely to report genuine threats when they see the programme as a safe learning loop rather than a trap. Trust improves detection quality.
Technical breakdown
Why click rates are a weak security signal
A click rate measures whether a user interacted with a simulation, but it does not tell you whether the user reported the message, whether the account had elevated access, or whether the user was already being targeted. That makes it a lagging indicator with limited governance value. Human Risk Management reframes the problem by treating user behavior as one input among several, not as the full story. The control question changes from “who clicked?” to “which users, in which access contexts, are most likely to create material exposure?”
Practical implication: stop using click rate as the primary success metric and add reporting rate, repeat-offender trends, and access context.
How phishing simulations become predictive in an HRM model
A predictive HRM model correlates simulation outcomes with identity data, access entitlements, and threat intelligence to estimate which users are most likely to be targeted or make risky decisions next. That is materially different from running isolated awareness exercises, because the signal is no longer just failure after the fact. The useful architecture is one that joins behavior telemetry with access and threat context, then uses that combined view to prioritize intervention. In practice, the value comes from predicting risk trajectories rather than scoring past mistakes.
Practical implication: integrate simulation results with identity and threat telemetry so risk scoring can support targeted intervention.
Why multi-channel phishing testing changes the control surface
Email-only simulations miss the fact that modern phishing is multi-channel. Attackers use SMS, voice, QR codes, and collaboration tools to bypass habits built around inbox hygiene. Once simulations extend across those channels, the control surface expands from email awareness to broader trust behavior. This is especially important where privileged users, finance teams, or help desk staff may receive lures through channels that appear operationally legitimate. The governance issue is not just whether users spot an email, but whether they can recognize social engineering across the channels where trust is exploited.
Practical implication: include smishing, vishing, and QR-based scenarios in testing for users who handle sensitive access or approvals.
Threat narrative
Attacker objective: The attacker objective is to exploit human trust to obtain credentials or authorised access that can be turned into account compromise or downstream misuse.
- Entry occurs when a user receives a realistic lure through email, SMS, voice, or QR code that imitates a trusted workflow or executive request.
- Credential access or compromise follows when the user clicks, enters credentials, or otherwise engages with the simulation pattern that mirrors real social engineering.
- Impact is reduced when the organisation uses the resulting signal to intervene before a real phish leads to account takeover, privileged misuse, or broader access abuse.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Click-rate culture is a measurement trap: organisations that treat simulation success as fewer clicks are optimising the wrong control. Clicks show exposure to a lure, not whether the programme is changing behaviour, reducing privilege risk, or improving reporting discipline. The more useful question is whether the programme can identify who is likely to create material business impact if they are targeted. Practitioners should move their governance model from failure counting to risk trajectory management.
Human Risk Management creates an identity bridge: phishing simulations only become strategically useful when they are correlated with access, identity, and threat signals. That is where IAM and awareness programmes intersect, because a user with privileged access and repeated risky behavior has a different control profile than a low-impact user who clicks once. The field is moving toward control design that combines behavioral telemetry with entitlement context. Practitioners should treat simulation data as a governance input, not a standalone awareness metric.
Predictive human risk is the right named concept here: it describes the shift from retrospective phishing testing to forward-looking identification of users and cohorts most likely to create exposure. The model matters because it supports intervention before credential entry, not after. That is a different security posture, and it is one that aligns awareness with identity governance rather than separating the two. Practitioners should build programmes that act on predicted risk, not just observed failure.
Simulation data only matters if it changes the control path: the article’s strongest operational point is that micro-training, reporting behavior, and threat correlation are what make the data actionable. Without those follow-up controls, simulations become theatre. With them, organisations can tune education, target high-risk cohorts, and show measurable behavior change. Practitioners should design the feedback loop before they scale the campaign volume.
The trust problem is as important as the phishing problem: programmes fail when employees feel tricked rather than trained. That is a governance issue, not just a communications issue, because fear suppresses reporting and undermines the very behaviors the control is meant to improve. A mature programme explains the purpose of simulations, uses private coaching, and avoids punitive scoring. Practitioners should protect trust as part of the control design.
From our research library:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
What this signals
Predictive phishing management will replace pass-fail awareness in mature programmes: organisations that keep treating simulations as a click test will miss the governance value of behavior telemetry. The shift is toward identifying which users and cohorts need intervention before a real phish arrives, which is where awareness, IAM, and threat intelligence begin to converge.
Identity context changes the meaning of simulation data: the same simulated failure can have very different risk significance depending on the user’s access scope and business role. That means security teams should use simulation outputs to steer training, access review prioritisation, and targeted coaching rather than to produce a single enterprise score.
Human risk programmes should be built around trust as well as telemetry: if employees think simulations are punitive, the control degrades because reporting falls and engagement drops. Practitioners need a governance model that normalises training, preserves psychological safety, and makes behavior change the primary objective.
For practitioners
- Replace click-rate reporting with outcome metrics Track report rate, repeat offender trends, and time-to-report so the programme reflects behavior change rather than simple test failure.
- Correlate simulation data with access context Join phishing results to identity, access, and threat telemetry so high-risk users are prioritised based on likely impact, not just interaction history.
- Add multi-channel phishing scenarios Test smishing, vishing, and QR-code lures alongside email because attackers do not confine social engineering to the inbox.
- Deliver immediate micro-training after risky interactions Use short, private follow-up training when a user engages with a simulation so the learning moment is tied to the risky behavior.
- Communicate the programme as a learning control Tell employees simulations are recurring security exercises, explain the purpose up front, and avoid public punishment or performance-linked shaming.
Key takeaways
- Phishing simulation software is becoming more useful as a predictive human risk control than as a simple awareness score.
- Behavioral data becomes materially stronger when it is joined to identity, access, and threat context.
- The control only reduces risk when it changes reporting, coaching, and intervention before a real phish succeeds.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001; TA0006 — Initial Access; Credential Access | Phishing simulations model the same social engineering path attackers use for initial access and credential theft. |
| Recommendation — Map simulation scenarios to TA0001 and TA0006 to prioritise training against real attack paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity context in simulation data depends on understanding permissions and entitlement scope. |
| Recommendation — Use PR.AA-05 to connect risky user behavior to the access that makes it material. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article ties phishing risk to user accounts, reporting behavior, and access privileges. |
| Recommendation — Apply CIS-5 to keep account risk, reporting, and privilege context aligned in awareness programmes. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Phishing aims at credentials, so authenticator management remains relevant to the risk this article discusses. |
| AT-2 — Awareness Training | The article is fundamentally about simulation-driven awareness and behavior change. | |
| Recommendation — Use IA-5 to reinforce credential protection and recovery controls around phishing exposure. Use AT-2 to structure phishing simulations as recurring awareness and evaluation activities. | ||
Key terms
- Phishing Simulation Workflow: A phishing simulation workflow is the process used to convert a real or representative attack message into safe training content. It preserves the lure mechanics that make the message believable while removing malicious payloads, sensitive data, and operational risk before delivery to employees.
- Human Risk Management: The practice of managing how people interact with security controls, especially under pressure, distraction, or deception. It combines training, policy, and friction management so identity systems are still usable enough that users do not bypass them in day-to-day work.
- Behavior-Triggered Micro-Training: Behavior-triggered micro-training is short, targeted learning delivered immediately after a risky user action. It works best when it is private, contextual, and specific to the behaviour just observed, because the lesson is tied to the exact decision that needs to change.
- Reporting Rate: Reporting rate is the share of employees who correctly identify and report a simulated or real phishing attempt. It is a stronger maturity signal than click rate because it reflects active detection behaviour. Higher reporting rates usually indicate better awareness, stronger security culture, and faster containment potential.
Deepen your knowledge
NHI Mgmt Group’s NHI Foundation Level course covers NHI governance, IAM, and secrets management in the context of identity-led security programmes. It is designed for practitioners who need to connect access control with operational risk across modern environments.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org