Phishing Failure Rate

What Phishing Failure Rate Measures

Phishing failure rate is a simulation metric, not a breach metric. It shows the proportion of people who took a risky action during a test, which makes it useful for understanding susceptibility, comparing groups, and tracking whether awareness efforts are changing behaviour over time.

Because the metric is based on simulated phishing, the exact definition matters. Some programmes count only clicks, while others include attachment opens, credential submission, form completion, or other predefined risky interactions. That choice affects whether the number is useful as a broad awareness indicator or a narrower measure of user response to a specific lure.

The most useful interpretation is directional, not absolute. A higher failure rate suggests users are still vulnerable to social engineering patterns, but it does not by itself prove real-world compromise, just as a lower rate does not guarantee that a live phishing campaign will fail.

Why Phishing Failure Rate Matters for Identity Security

In identity security, phishing failure rate is important because many phishing campaigns are designed to steal credentials, capture session tokens, or trigger approvals that lead to account compromise. The metric therefore sits at the intersection of human behaviour, authentication risk, and exposure to downstream misuse of identity privileges.

It also gives defenders a way to compare risk across populations and scenarios. Teams can use it to see whether executives, contractors, or specific business units are more likely to interact unsafely, and whether certain lure styles are more effective than others. That makes it useful for prioritising awareness work and control hardening.

For a deeper view of the attack patterns behind these outcomes, Phishing Guide covers common phishing types, kit-based delivery, lookalike domains, and layered defences.

How Organisations Interpret and Use the Metric

Phishing failure rate should be read alongside the structure of the simulation. A campaign that uses a highly convincing lure, an unusual delivery channel, or a targeted audience may produce a higher failure rate without indicating that awareness controls are failing uniformly. The context behind the test matters as much as the percentage itself.

Strong programmes often pair failure rate with report rate, repeat-offender trends, and the time it takes users to report suspected phishing. That combination gives a more balanced view of resilience than failure rate alone, because it distinguishes between users who click, users who report, and users who simply ignore the message.

When simulations include credential capture or other identity-related interaction, organisations should treat the results as a signal to review authentication hardening, reset assumptions about user trust, and check whether the same lure could succeed against real services.

Limits, Benchmarking, and Control Context

Phishing failure rate is most valuable when it is used consistently. If the measurement rules change from one campaign to the next, trend lines become hard to trust. A programme that counts only clicks cannot be compared cleanly with one that also counts attachment opens or form submissions.

Benchmarks are useful, but they should not replace local context. A low failure rate in one department may reflect prior training, better reporting habits, or simply less exposure to targeted campaigns. A high rate may indicate a gap in awareness, but it may also reveal that the simulation design is finally realistic enough to measure meaningful behaviour.

For programme design and metric interpretation, Phishing Simulation Programme Guide addresses simulation ethics, reporting metrics, difficulty tuning, and allowlisting concerns.

Risk and Threat Considerations

Phishing failure rate matters because phishing is often the first step in credential theft, session hijacking, or fraudulent approval flows. A high failure rate can expose an organisation to account takeover risk even when no compromise has yet been confirmed, because the same user behaviour that appears in simulation often maps directly to real attack paths.

Failure mechanism: Attackers exploit human trust, urgency, and routine task handling to persuade users to click, sign in, approve, or disclose information, then use the resulting access to move into mail, cloud, or business systems.

Impact: The likely consequences include credential compromise, token theft, unauthorised access, privilege abuse, and follow-on phishing from trusted accounts, especially when the same identity is reused across multiple services.

Practitioner Guidance

Why practitioners should care: Treat the metric as a control-health indicator, not as a success score. A falling failure rate is only meaningful when the organisation can show that training, reporting, authentication hardening, and simulation design all changed in the same direction.

Common misunderstanding: Teams sometimes optimise for the lowest possible failure rate and lose sight of whether users can recognise and report suspicious messages. A programme that over-penalises clicks without improving reporting behaviour may create a brittle metric rather than better resilience.

Practitioner takeaway: Use phishing failure rate alongside report rate and repeat-user analysis so the number reflects real defensive maturity, not just test performance.

Related resources from NHI Mgmt Group

• What is the difference between failure rate and reporting rate in phishing simulations?
• How should security teams use phishing failure rate without overestimating program success?
• When does consent phishing become a governance failure rather than a user mistake?
• What breaks when teams do not test auth failure paths like 422, 500, or rate limiting?