Topic starter
27/06/2026 1:47 pm
TL;DR: Researchers from the University of Chicago and UC San Diego found most corporate training programs do little to reduce phishing risk, while Verizon’s 2025 DBIR links the human element to roughly 60% of breaches and Abnormal AI’s new scoring model shifts teams from click-rate proxies to behavioural measurement. The real assumption breaking here is that completion and click metrics can stand in for actual preparedness.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “AI-First Human Risk Management That Prepares Your People Without Slowing Down the Business”.
Key questions
Q: How should security teams measure phishing risk beyond click rates?
A: Use layered behavioural signals instead of a single click metric.
Q: Why do training completion rates fail as a phishing readiness measure?
A: Because completion measures administration, not resilience.
Q: What are the signs that phishing awareness is not reducing real risk?
A: The clearest signs are stable or rising susceptibility scores, repeat failures on realistic simulations, and little difference between people who completed training and those who did not.
Practitioner guidance
- Replace click-rate reporting with behavioural risk scoring Track opens, submissions, and tactic-specific susceptibility together so leaders can see whether risk is trending down across the workforce.
- Segment coaching by observed susceptibility Use risk tiers to target follow-up training and intervention only where the behavioural data shows higher exposure.
- Add relationship-based BEC and VEC simulations Test manager, colleague, and vendor scenarios that rely on context and trust rather than links or attachments.
Bottom line: Phishing defence is moving away from completion and click-rate proxies because those metrics do not prove that employee behaviour is safer.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:14 pm
Click-rate proxies are no longer sufficient for human risk governance. Completion tracking and simulation clicks were useful when the goal was programme coverage, but they do not measure whether employees are less exploitable. Human risk management has to answer a harder question: who is actually more or less likely to respond to a realistic lure. The implication is that security teams need to govern susceptibility as a living risk signal, not an annual training artefact.
A few things that frame the scale:
- 74% of all breaches included the human element, through error, privilege misuse, stolen credentials or social engineering, according to Verizon's 2023 Data Breach Investigations Report.
A question worth separating out:
Q: How should teams measure employee susceptibility to business email compromise?
A: Use simulations that mirror actual workflow abuse, including manager, colleague, and vendor requests that look legitimate but create false urgency or financial pressure. Measure whether employees reply, comply, escalate, or challenge the request, then use those patterns to guide targeted coaching.
👉 Read our full editorial: Human risk management is replacing phishing click-rate proxies