Topic starter
27/06/2026 1:56 pm
TL;DR: Credential theft drives about 50% of breaches, according to Abnormal AI, yet most simulations still track clicks rather than credential entry, which is the more serious breach indicator. The practical shift is from awareness reporting to behavior-based risk measurement, because completion metrics alone do not tell security leaders whether training reduces exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “From Data to Defense: Unlocking Executive Insights and Credential Training”.
Key questions
Q: What breaks when phishing simulation programmes rely only on click-through rates?
A: Click-through rates alone create a narrow and often misleading view of risk.
Q: Why do credential phishing simulations matter more than generic awareness tests?
A: Credential phishing simulations matter because they model the attacker goal, not just user attention.
Q: What should organisations do after employees submit credentials in a simulation?
A: Treat the result as a risk indicator, not a training score.
Practitioner guidance
- Measure credential submission separately from clicks Track whether users entered credentials, not only whether they opened or clicked a simulated message.
- Segment users by risky simulation outcomes Break results down by department, role, and repeated failure patterns so the same remediation is not applied to every employee.
- Trigger targeted follow-up after failed simulations Send focused coaching or security review to users who submitted credentials in a simulation, because that behaviour is closer to real breach exposure than a generic click event.
Bottom line: Credential phishing simulations are most useful when they measure credential submission, because that is the behaviour that maps to real compromise risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:28 pm
Click-rate awareness programs miss the governance event that matters. A user who clicks a phish has not necessarily created identity risk, but a user who submits credentials has crossed into a materially different control state. That is why human-risk measurement should treat credential entry as the relevant threshold, not the weaker proxy of click behaviour. For IAM and security leaders, the programme question is whether reporting captures the point where authentication risk becomes real.
A question worth separating out:
Q: How can organisations tell if human-risk management is working?
A: Look for downward trends in behavioural susceptibility, improved performance in realistic simulations, and better targeting of coaching to higher-risk groups. If the programme only reports attendance or click rates, it is measuring activity, not security improvement.
👉 Read our full editorial: Credential phishing simulations expose human risk beyond click rates