Phishing Report Rate

What Phishing Report Rate Measures

Phishing report rate is a behaviour metric, not a knowledge quiz score. It measures whether people notice suspicious mail, trust their own judgement, and take the extra step of reporting it, which is why it gives a better signal of active defence than simple course completion.

Because it tracks real user action, the metric helps distinguish awareness in theory from awareness in practice. A high rate usually suggests that people understand the reporting path and are willing to use it, while a low rate can indicate weak recognition, poor confidence, or friction in the reporting process.

Why Report Rate Is More Useful Than Click Rate Alone

Click rate only tells you how many users interacted with a lure. Report rate tells you how many users identified the same lure as suspicious and escalated it. Those are different behaviours, and the second is often more valuable operationally because it can shorten attacker dwell time and feed faster response.

In practice, report rate is most useful when read alongside click rate, time-to-report, and message quality. A campaign with few clicks but also few reports may still be weak if users ignored the email rather than recognised it. A campaign with moderate clicks but strong reporting may indicate that the organisation is building useful defensive habits.

NHIMG’s Phishing Simulation Programme Guide explains why report rate is a better metric than click rate for judging simulated phishing maturity.

What Affects Phishing Report Rate

Report rate is shaped by a mix of user behaviour and programme design. Clear reporting buttons, simple instructions, and timely feedback all make reporting more likely, while confusing simulations or punitive culture can suppress it. The metric therefore reflects both awareness and the ease of doing the right thing.

Campaign design matters too. If messages are too obvious, report rate may look strong without testing real judgement. If they are too difficult or unfamiliar, the rate may fall because users cannot recognise the signal. A good programme uses difficulty deliberately so the metric remains meaningful over time.

NHIMG’s Security Culture Measurement Guide shows how reporting behaviour can be used as one of the signals of a healthier security culture.

The Phishing Simulation Programme Guide also covers ethics, allowlisting, and the need to separate reporting behaviour from simple exposure to difficult lures.

How Organisations Should Interpret the Metric

Report rate should be interpreted as a trend, not a verdict. The useful question is whether more people are reporting suspicious messages over time, and whether those reports are arriving earlier and with better quality. That makes the metric more valuable as a change indicator than as a one-off score.

It also needs context. Different populations, business units, and reporting tools will produce different baselines, so comparing raw numbers without segmenting the audience can lead to false conclusions. The strongest interpretation comes from looking for sustained improvement and linking the metric to real operational outcomes such as faster triage and fewer successful phishing attempts.

NHIMG’s Phishing Report Button and User Reported Message Triage Guide shows how reporting data becomes useful only when the organisation can triage and act on it quickly.

The Security Awareness Plan Template ties report rate to a broader awareness programme so the metric supports behaviour change rather than becoming a standalone vanity measure.

Risk and Threat Considerations

A low phishing report rate can leave malicious email in circulation longer, reduce the chance of early containment, and weaken the organisation’s view of what users are seeing. It can also mask whether users are learning to recognise suspicious messages or merely failing to respond.

Failure mechanism: If people do not report suspicious messages, defenders lose an early-warning signal, reporting queues stay empty, and malicious campaigns can progress farther before containment.

Impact: The organisation may see more credential theft, more successful follow-on compromise, and slower incident response because the first human signal never reaches security teams.

Practitioner Guidance

Why practitioners should care: Treat phishing report rate as a programme quality signal, not just a user score. The metric is most useful when it rewards timely, accurate reporting and when the reporting path is easy enough that users actually use it.

Common misunderstanding: A rising report rate does not always mean users are “more secure” in a broad sense. It may simply mean the reporting workflow is clearer or the simulations are better tuned, so the metric should be interpreted alongside time-to-report, click rate, and triage quality.

Practitioner takeaway: Use report rate to measure whether awareness is translating into protective action, then validate that the organisation can absorb and respond to those reports quickly.

Related resources from NHI Mgmt Group

• Guide: Phishing Guide
• How should security teams improve phishing report handling without overloading analysts?
• What should teams do when a user report reveals a real phishing campaign?
• How should teams reduce low-value phishing report tickets without weakening user reporting?
• What should security teams do when a phishing report includes a click or credential entry?