Why do phishing simulation results need to be combined with identity and threat intelligence data?

Why Simulation Scores Need Identity and Threat Context

Phishing simulations are often treated as a simple pass or fail exercise, but that view misses the security question that matters most: who is actually exposed if the user clicks. A low-risk employee, a finance approver, and a privileged administrator can all produce the same simulation result while representing very different business consequences. Identity context turns a behavioural signal into an exposure signal, and threat intelligence shows whether the organisation is currently being targeted in ways that make the result more urgent.

That distinction matters because phishing is not only about awareness. It is also about access paths, privilege, and attack likelihood. A simulation result that sits outside the user’s role, session history, and current threat pattern can lead to misleading comfort or misplaced escalation. NHI Management Group recommends using simulation data with identity data and current intelligence so teams can separate broad training metrics from actionable risk. In practice, many security teams discover the real value of simulation only after a credential or account abuse investigation reveals that the users who clicked were already on an attacker’s shortlist.

For current threat context, CISA cyber threat advisories are useful because they help security teams align user behaviour signals with active campaigns and known lure themes.

How the Combined View Changes the Security Decision

Simulation results become materially more useful when they are joined to identity and threat data because the organisation can ask three different questions at once: who clicked, what that person can access, and whether current adversary activity makes that click more likely to be weaponised. The first question is behavioural. The second is about potential blast radius. The third is about timing and exposure.

Identity data adds the role-based layer that most raw simulation dashboards miss. A click from a user with standard access may justify coaching and monitoring, but a click from someone with access to email forwarding rules, finance systems, privileged admin portals, or sensitive customer records may justify faster review, containment, or targeted verification. This is especially important where the organisation has delegated access, service ownership, or approval authority spread across functions. The same click result can mean very different outcomes depending on whether the user can only read information or can also approve, transfer, reset, or escalate.

Threat intelligence adds the external pressure signal. It helps teams distinguish generic awareness failure from a response to an active campaign family, a targeted sector lure, or a technique currently used against similar organisations. That matters for prioritisation, because simulation data alone tells you where users are vulnerable, while intelligence tells you whether the environment is being probed in a way that increases the chance of follow-on compromise. Where both signals line up, security teams can move from broad training reporting to risk-based intervention. For campaign context, ENISA Threat Landscape gives a broader view of recurring phishing and social-engineering patterns that can help frame those judgments.

• Use identity data to rank the consequence of a click, not just the frequency of clicks.
• Use threat intelligence to decide whether a simulation result reflects a general habit or a live exposure pattern.
• Use both together to focus coaching, verification, and monitoring on people whose compromise would matter most.

Where this approach breaks down is when organisations treat identity fields as static and threat feeds as generic, because then the combined view adds complexity without improving decision quality.

Where the Edge Cases Create False Confidence

Tighter scoring often increases reporting overhead, requiring organisations to balance simplicity against the accuracy needed to prioritise risk. That tradeoff becomes visible in edge cases, especially when a user’s role changes, a temporary delegation exists, or the threat feed is too broad to identify what is actually relevant.

One common problem is stale identity context. If access reviews, role mappings, or joiner-mover-leaver records are outdated, the simulation result may be linked to the wrong exposure profile. Another is over-interpreting threat intelligence. A broad advisory about phishing does not automatically make every simulation click urgent; the intelligence must add specificity about the lure, actor, or technique. Industry practice is not fully settled on the best weighting model here, so teams should label their approach as guidance rather than consensus when they are using local scoring rules.

Another edge case is where simulations are used as a disciplinary metric. That creates pressure to optimise for the score instead of improving exposure reduction. In those environments, teams may hide the most important signal by reducing participation, encouraging gaming, or flattening all roles into one awareness tier. The better approach is to treat the combined dataset as a prioritisation layer: it should tell the organisation who needs follow-up, what kind of follow-up is appropriate, and where a click becomes operationally significant. For that reason, simulation data should be interpreted alongside access scope, not apart from it, because a click is only a training event until the account behind it can move data, authorise action, or help an attacker persist.

Practitioner Guidance

What to prioritise: Prioritise users whose click history intersects with elevated access, sensitive approvals, or externally targeted business functions. That is where the combined signal changes the security outcome most, because the same behaviour creates very different exposure depending on role.

What to verify: Verify that identity attributes used in scoring are current enough to reflect actual access, delegation, and privilege. If role and access data lag behind reality, the output will look analytical but still mis-rank the risk.

Decision rule: If a simulation click aligns with both higher privilege and a current lure pattern, treat it as a targeted exposure issue rather than a generic awareness miss. If only one of those conditions exists, keep the response proportionate and avoid over-escalation.

Practitioner takeaway: The useful unit of measurement is not the click itself, but the click in context of access and current targeting, because that is what determines whether the event is merely informational or operationally consequential.

Related resources from NHI Mgmt Group

• Why is it important to integrate identity and data governance?
• Why does identity data improve threat intelligence in modern environments?
• What breaks when threat simulation is not connected to employee behavior and identity data?
• Why do silos between behavior data, identity systems, and threat intelligence weaken risk mitigation?