Who should own follow-up when employees keep clicking phishing simulations?

Why the follow-up should stay human, not automated

The platform can identify repeated risky behavior, but it cannot decide whether the right response is coaching, a manager conversation, a targeted refresher, or a formal exception. That decision depends on context the simulation platform does not have, including role, prior performance, local policy, and whether the behavior is isolated or part of a broader pattern.

When organisations treat the tool as the owner, they often optimise for a dashboard outcome instead of a behavior outcome. The useful question is not how many times someone clicked, but whether the response changes the person’s future decisions in a measurable way.

A Phishing Simulation Programme Guide is the right reference point when you want to tune the programme itself, but the follow-up decision still belongs to a human reviewer who can interpret the result in context.

What good follow-up looks like after repeated clicks

Repeated clicking should trigger a review path, not an automatic punishment path. The first step is to confirm whether the user saw the simulation, understood the cues, and had enough knowledge or time to respond correctly. If the pattern continues, the response should become progressively more targeted, for example manager involvement, role-specific coaching, or a stronger intervention for high-risk functions.

Good follow-up also distinguishes between a single lapse and a sustained behavior issue. Someone who clicks once after a busy week is different from someone who repeatedly ignores warning signs across multiple campaigns. The second case is where human judgment matters most, because the right response may involve workload, process friction, or accountability, not just more generic training.

Security Awareness and Human Risk Management Guide is useful here because it frames repeated unsafe behavior as a human-risk problem, not just a simulation metric.

What the platform should do, and what it should not decide

The platform should detect, record, and route the case. It should flag repeat clickers, preserve the evidence, and make it easy to see trendlines across campaigns. It should not decide consequences on its own, because the same metric can mean different things in different teams, job roles, and business contexts.

This is where measurement discipline matters. Report rate, click rate, and repeat-click patterns are useful signals, but they do not tell you whether the person needs coaching, whether the simulation was too deceptive, or whether the business role justifies a different threshold for follow-up. Human review closes that gap.

Security Awareness Training Buyer’s Guide helps when you are evaluating platforms, but the buying decision should still preserve a human-owned workflow for exceptions and escalation.

Risk and Threat Considerations

Repeated simulation clicks can signal a real exposure path if the same user later faces a live phishing lure. The risk is not the click itself, it is the possibility that the organization keeps measuring behavior without correcting it, which leaves a known weak point in place.

Failure mechanism: The platform records events but no one applies context, so repeat behavior is normalized, false confidence grows, and the next real phishing attempt finds an unchanged user response pattern.

Impact: A live phishing email, OAuth consent lure, or credential theft attempt is more likely to succeed because the organization mistook measurement for remediation.

Practitioner Guidance

Decision rule: If the same person keeps clicking across multiple simulations, move from generic nudges to a human review that asks why the behavior is persisting and what intervention is proportionate.

What to verify: Check whether the simulation was clearly marked, whether the user received prior coaching, and whether the team has a documented escalation path for repeat unsafe behavior. If none exists, create one before increasing campaign volume.

What practitioners underestimate: Repeated clicks are often treated as a training KPI, but the better operational signal is whether follow-up changes future behavior. A smaller number of well-owned interventions is usually more effective than automated mass escalation.

Practitioner takeaway: Use the platform to surface repeat behavior, but keep the accountability, judgment, and escalation decision with a person who can judge context and choose the least disruptive effective response.

Related resources from NHI Mgmt Group

• What should organisations do when users keep clicking on phishing simulations?
• When does an NHI become too risky to keep as-is?
• Who should own follow-up after a cybersecurity audit finds access gaps?
• How can teams keep phishing simulations from harming trust?