How should security teams measure phishing risk beyond click rates?

Why This Matters for Security Teams

A single click rate is a weak proxy for phishing risk because it collapses different behaviours into one outcome. A user who opens a message, enters credentials, then reports it is very different from a user who clicks and silently complies, yet many programmes treat both as equivalent. Security teams need measures that reflect real exposure: credential submission, reply behaviour, repeated susceptibility, and role-based patterns. That is especially important when phishing outcomes feed into broader identity and access risk decisions, which is why NHI discipline and human awareness testing should be aligned rather than siloed, as discussed in the Top 10 NHI Issues and the NIST Cybersecurity Framework 2.0. In practice, many security teams discover that click metrics improved long before actual phishing resilience did.

How It Works in Practice

A better model uses layered behavioural signals and trends rather than one campaign score. Start by separating the actions that matter operationally: opening the lure, interacting with links or attachments, submitting credentials, replying to the sender, and escalating the message through reporting channels. Then segment those outcomes by role, business unit, geography, and scenario so the data shows where risk concentrates. Practitioners often combine this with repeat exposure analysis. A single accidental click may not justify heavy intervention, but repeated susceptibility to the same tactic usually indicates a coaching gap or a workflow weakness. Current guidance suggests measuring both absolute outcomes and change over time, because improvement is more meaningful when a team can show fewer credential submissions, faster reporting, and lower repeat susceptibility across campaigns. That approach also aligns better with board reporting than raw completion rates, which can be gamed by low-complexity tests. Useful signals include:

• Credential submission rate, not just click rate
• Report rate and mean time to report
• Repeat susceptibility by user and tactic
• High-risk role exposure, such as finance, HR, and executives
• Post-campaign follow-through, including reset, coaching, and access review

This is also where the NHIMG research on the 2024 ESG Report: Managing Non-Human Identities becomes relevant: it shows how organisations can miss the real risk picture when they focus on surface metrics rather than compromise patterns. For teams building a maturity view, the Ultimate Guide to NHIs — Why NHI Security Matters Now is a useful companion for linking awareness outcomes to identity governance. These controls tend to break down in highly automated helpdesk environments because social engineering, identity reset workflows, and campaign telemetry are not connected end to end.

Common Variations and Edge Cases

Tighter measurement often increases programme overhead, requiring organisations to balance richer insight against reporting complexity and privacy constraints. Not every phishing exercise should be judged the same way. Low-risk awareness drills can use broad trend metrics, while high-risk simulations aimed at privileged or regulated roles need stricter segmentation and a stronger response workflow. There is no universal standard for this yet, but current guidance suggests avoiding per-user public shaming and avoiding over-optimisation for one metric. If the team rewards low clicks alone, users may report less or become desensitised to simulations. If the team only measures report rate, it may miss credential theft behaviours that create immediate account compromise risk. The best practice is evolving toward composite scoring that weights context, such as message realism, target role, and whether the user has access to sensitive systems. A practical edge case is executive phishing, where a small number of high-impact users can dominate organisational risk. Another is repeated simulations against the same group, which can distort results if the audience becomes test-aware. For those cases, reporting should focus on trend lines, control effectiveness, and remediation quality rather than a single campaign result. The broader lesson from the OWASP NHI Top 10 is that identity risk becomes clearer when telemetry, governance, and response are analysed together, not in isolation.

Related resources from NHI Mgmt Group

• How should security teams reduce phishing risk when attacks blend into normal work?
• How should security teams reduce the risk of MFA bypass through AiTM phishing?
• How should security teams measure progress in NHI governance beyond risk scores?
• How should security teams respond when a phishing URL scans clean?