Why do phishing simulations fail to show real security culture?

Why click-rate metrics miss real security culture

Phishing simulations are useful for training and measurement, but they do not capture the behaviours that matter most in day-to-day security culture. A low click rate can coexist with poor reporting habits, weak escalation, or a workplace where people still feel pressure to work around controls instead of challenging suspicious activity.

That is why mature programmes treat simulations as one signal, not the culture score itself. A good culture is more visible in whether people report quickly, ask for verification, and route suspicious messages to the right team without friction.

For a broader view of how awareness programmes should be designed and measured, see Security Awareness and Human Risk Management Guide and Security Culture.

What real culture looks like in practice

Real security culture shows up in the behaviours that happen after someone notices something suspicious. That includes using the report-phish path, escalating to SOC or IAM teams when a request looks unusual, and challenging identity or payment changes that do not fit normal business patterns.

It also shows up in what people do when they are busy. If employees slow down to verify an unexpected link, vendor change, or MFA prompt instead of improvising, that is a stronger culture signal than a single simulation result. Culture is therefore a workflow property, not just a test score.

The practical question is whether people know what to do, can do it quickly, and believe they will be supported when they raise a concern. That is the link between behaviour, process design, and the organisation’s tolerance for risky shortcuts.

For programme design that measures behaviour change rather than just training completion, use Human Risk Management Programme Guide and Security Culture Measurement Guide.

How to measure culture without overtrusting simulations

Use phishing simulations as one input, then triangulate them with metrics that reflect real operational behaviour. The most useful indicators are reporting rates, time to first report, escalation quality, repeat risky workarounds, and whether leadership reinforces reporting instead of blaming mistakes.

Measure whether people know the path, use the path, and trust the path. If reporting volume is low, that may indicate poor awareness, poor access to the report mechanism, or a culture where people assume nothing will happen after they speak up. A simulation alone cannot separate those conditions.

Good measurement also looks across teams. A strong culture in one function can mask weak reporting norms elsewhere, so the metric set should be segmented by role, department, and control exposure rather than averaged into a single enterprise score.

Risk and Threat Considerations

When organisations overvalue simulation click rates, they can miss the real exposure: delayed reporting, silent compromise, and staff who do not escalate suspicious activity fast enough for containment. Attackers benefit most when people hesitate, normalise unusual requests, or route problems through informal workarounds.

Failure mechanism: A simulation rewards test avoidance, while the actual attack succeeds through delayed detection, weak challenge behaviour, or poor handoff to response teams.

Impact: Suspicious messages remain active longer, compromise is harder to contain, and the organisation may falsely believe its people are more resilient than they really are.

Practitioner Guidance

What to prioritise: Put reporting and escalation behaviour ahead of raw click rate when you assess culture. If people can report quickly and without stigma, the organisation gains earlier visibility even when some users still make mistakes.

What to verify: Check whether reported phish actually reach the right workflow, whether SOC or IAM teams respond consistently, and whether employees can describe the next step after clicking or suspecting a message. If they cannot, the measurement is not yet culture-aware.

Practitioner takeaway: Simulations are useful for awareness discipline, but culture only becomes real when people reliably surface risk, challenge unusual requests, and trust the response path.

Related resources from NHI Mgmt Group

• Why do basic phishing simulations often fail to show real human risk?
• Why do phishing simulations fail as a security metric when organisations focus only on clicks?
• How should security teams implement AI-generated phishing simulations in a way that improves real behaviour change?
• Why does native file auditing on Windows often fail to show real security risk?