Simulated phishing is one of those security controls that everyone agrees is a good idea and almost nobody implements well. The difference between a program that actually changes behavior and one that just generates monthly reports is not the tool, it's the way the program is structured, communicated, and followed through.
01The metrics that matter.
Click rate is the metric everyone tracks. It is also the least useful metric in isolation. A team with a 2% click rate and a 5% report rate is worse than a team with a 4% click rate and a 35% report rate, because the second team is actively watching for threats and flagging them to IT.
Report rate, the percentage of simulated phish that get reported via the "Report Phishing" button, is the true leading indicator of security culture.
02Cadence: quarterly beats monthly.
Monthly phishing simulations desensitize users. They become a recurring nuisance, clicked without thought, reported mechanically. Quarterly cadence, four well-designed simulations per year, gets better behavioral results.
What matters is not frequency but variety. Rotate through the attack patterns that actually appear in the wild: Microsoft login pages, shared-document lures, HR/benefits themes, shipping notifications, and executive-impersonation attempts.
03Training at the moment of failure.
The best teaching moment is the three seconds after someone clicks. Platforms like KnowBe4, Proofpoint Security Awareness, and Hook Security can interrupt the click with a landing page that explains the specific tells: the domain, the urgency cue, the mismatched link text.
90 seconds of targeted training at the moment of failure beats 60 minutes of recorded video in a separate annual module every time.
04Don't shame. Coach.
The fastest way to destroy a security culture is to publicly call out users who click. The second-fastest is to send screenshots to their manager. Both practices exist; neither works.
Effective programs track by team, not by named individual, and escalate coaching, not punishment. A user who fails three simulations in a row gets a 15-minute 1:1 with a security engineer, not a HR note in their file.
05Tie the program to something real.
Simulations should reference real incidents your firm or industry has faced. A law firm that recently saw a wire-fraud attempt should run a simulation based on that exact pattern. A medical practice that got spoofed invoices should see a simulated vendor-impersonation campaign next quarter.
Relevance drives engagement. Engagement drives behavior change.
Quarterly phishing at $3–$6 per user per month, four curated campaigns a year, per-team reporting that never names individuals, and a 15-minute engineer 1:1 for anyone who fails three in a row. No shame emails to managers, ever.