There is no universal good phishing simulation click rate, because the number moves with template difficulty, audience and how the campaign was sent. As a working guide, mature programmes see single figure click rates on standard scenarios. The more meaningful measure is your report rate and whether it is rising while click rate falls.
What does phishing simulation click rate actually measure?
Click rate is the proportion of people who received a simulated phishing email and clicked the link inside it. Most platforms express it against the number of recipients rather than the number who opened the message, since open tracking is unreliable once image blocking and preview panes are involved.
What it tells you is narrower than it first appears. A click means someone found the message plausible enough to act on for a moment. It does not tell you whether they would have entered their password, whether they realised a second later, or whether they went on to report it. Plenty of people click, feel uneasy and immediately flag the email, which is a much better outcome than the same person quietly deleting it.
This is why click rate should never travel alone in a report. It is one input into a picture of behaviour, and on its own it is the input most easily gamed.
What is a realistic click rate benchmark?
Published benchmarks vary enormously and the reason is not that some workforces are ten times more careless than others. It is that vendors measure different things, using templates of wildly different difficulty, against audiences with different levels of exposure.
Rather than chase an industry average, it helps to think in terms of programme maturity. Organisations running their first ever simulation with a moderately convincing template usually see a double figure click rate, and the first campaign is often the highest number the programme will ever produce. After a few cycles of simulation paired with immediate training, standard scenarios typically settle into single figures. Hard scenarios, meaning personalised pretexts that use internal context, urgency or authority, will always pull that number back up, and they should.
The Boxphish dataset makes the training effect concrete, analysis of more than 400,000 platform users found that untrained users are 8.8 times more likely to click a phishing email than trained users. That gap, rather than any single benchmark figure, is the thing a programme is trying to move.
It is also worth keeping the external picture in view. The government's Cyber Security Breaches Survey 2025/2026 found phishing to be the most prevalent attack type by a wide margin, experienced by 38% of businesses, and it accounted for 93% of business cases where cyber crime occurred. A click rate that looks acceptable in isolation still represents a meaningful number of people in an organisation where phishing is the most likely attack to arrive.
Why comparing your click rate to someone else's is usually a mistake
Five variables move the number so much that cross organisation comparison rarely means anything.
- Template difficulty - A generic parcel delivery notice and a spoofed message from a named internal system will produce results that differ by a factor of several, on the same day, in the same organisation.
- Sending method - A simultaneous send to everyone lets word spread, which suppresses the number artificially. Staggered sends, or sending a different scenario to each person, produce a truer reading.
- Automated clicks - Security scanners that follow links on behalf of users can inflate results, sometimes dramatically, if the sending infrastructure has not been configured correctly.
- Audience composition - Teams that handle external mail all day, such as recruitment, finance or admissions, are more exposed by the nature of the job, not by carelessness.
- Programme age - An organisation twelve months into a training programme is not comparable to one running its first exercise, whatever the sector.
The comparison that does mean something is against yourself. Same template difficulty, same audience, three months apart, is a real measurement. Everything else is context.
The metrics that matter more than click rate
The National Cyber Security Centre is blunt on this point in its phishing guidance, warning that metrics express an organisation's values, and that if you appear to value the absence of reported problems, you incentivise people to keep quiet about them. A programme reported purely on click rate quietly teaches staff that the safest thing to do after a mistake is nothing.
A better dashboard tracks four things alongside it.
The report rate is the proportion of recipients who flagged the simulation through your reporting button or the service desk. This is the number to grow. In a live incident, reports are what let your security team pull a malicious message from every inbox before it spreads, and no amount of click avoidance substitutes for that.
The time to first report tells you how quickly your organisation would begin responding to a real campaign. Minutes is excellent, hours is workable, days means the message would have done its work long before anyone acted.
The credential submission rate matters far more than a click. On a second stage simulation, where the link leads to a realistic sign in page, submission is the behaviour that would actually hand an attacker access. It is usually a much smaller number than the click rate, and it deserves separate attention.
Repeat interaction is a small group of people caught by successive campaigns will often account for a disproportionate share of your real risk. Sending them the same module a fourth time will not fix it, and the answer usually lies in workload, process or the specific pressures of their role.
How to set a baseline you can trust
Run your first campaign before any announcement of a training programme, using a template of moderate difficulty that reflects mail your staff genuinely receive. Do not choose the easiest scenario in the library to make the opening number look good, and do not choose the hardest to make the case for budget. Both distort every comparison that follows.
Record the difficulty level alongside the result, then hold that difficulty steady for your comparison campaigns. Vary difficulty in the other campaigns by all means, that is how you keep the programme honest, but keep one recurring test that always sits at the same level so you have a clean trend line.
Segment the baseline from the start, by department, site and role. Aggregate numbers hide the interesting parts. A 7% organisational click rate that is actually 3% across most of the business and 22% in one team tells a story that the headline never will.
What good looks like over twelve months
A healthy programme shows a pattern rather than a single figure. Click rate on standard scenarios falls in the first few cycles, then flattens, because there is a floor below which no workforce goes. Report rate keeps climbing well after click rate has settled, and that continued climb is the sign that culture is shifting rather than just caution.
Time to first report shortens, credential submission becomes rare and the gap between your best and worst performing teams narrows. Harder templates still produce clicks, which is a sign that you are still testing something real rather than administering a formality.
If click rate has fallen to almost nothing and report rate has flatlined, the most likely explanation is not that your organisation has been solved. It is that your templates have become too easy, or that word gets around before the send finishes.
Reporting click rate to a board
Boards do not need the raw percentage as much as they need the trajectory and the exposure. Three things travel well in a board pack: the trend against a consistent template, the report rate as evidence of a functioning human sensor network, and the residual risk concentration, meaning which parts of the organisation would most likely be the entry point.
Benchmarking against comparable organisations is useful at this level, provided everyone understands its limits. It answers the question a board actually asks, which is whether the organisation is roughly where its peers are, while your internal trend answers whether it is getting better.
For the wider measurement picture, including how simulation data sits alongside training completion and behaviour change, see our guide to how phishing simulations fit into a cyber security awareness training programme.
Frequently asked questions
What is an average phishing simulation click rate?
Published averages range widely because template difficulty and sending method differ so much between organisations. First campaigns commonly land in double figures, while established programmes usually see single figure click rates on standard scenarios.
Is a 0% click rate good?
Not necessarily. A zero result usually means the template was too easy or word spread during the send. It is worth checking the report rate at the same time, since a campaign nobody clicked and nobody reported has told you very little.
What is a good phishing report rate?
Aim for a report rate that exceeds your click rate and keeps rising campaign on campaign. The direction of travel matters more than the absolute figure, because reporting culture builds gradually.
Should click rate be reported by individual?
No. Individual league tables reliably damage the reporting culture you are trying to build. Report by team and trend, and handle repeat interaction privately with the person and their manager.
How quickly should click rate improve?
Most organisations see the sharpest movement across the first three or four cycles, then a slower decline that flattens. If it drops to almost nothing immediately, check the difficulty of the templates being used.
Boxphish reporting shows click rate, report rate and time to report side by side, with risk scoring at individual and organisation level. Book a demo to see how the numbers look in practice, or read more about phishing simulations and reporting and analytics.
