Simulated phishing clicks rose for six months of training before they fell

The six-month peak sits where the testing is heaviest. Users at that stage received an average of 3.5 simulations per person, against 2.6 at three months and 2.8 at 12 months ^[9]. That is about 35% more mail per person than the three-month group got ^[21]. Half of it was difficult: 50.4% of six-month simulations were classified Hard ^[10]. After that stage the mix held at roughly 50% Hard while clicking and credential submission fell ^[11]. The fall is therefore measured against a steady difficulty mix. Over the stretch where clicks were rising, frequency was still climbing toward the six-month figure ^[9].

The stages compare overlapping but non-identical groups of organizations and users that had reached the three-, six-, nine- and 12-month marks of their programs ^[8]. Pistachio says the temporary increase in clicks can reflect more demanding and frequent testing that exposes vulnerabilities easier exercises may miss, instead of indicating that employees are becoming less resilient ^[7]. Neither the rise nor the fall is a measurement of one workforce improving.

"A low click rate can create a false sense of security. Clicking a phishing link is just one moment in a much longer chain of employee behaviour, and on its own it says little about whether someone, or the organisation as a whole, is actually getting more resilient," said Joe Jones, CEO of Pistachio ^[5]. Pistachio sells the simulations, and its report's central finding is that resilience reads best as a combination of clicking, credential submission and reporting behavior ^[6]. One mechanism it names is checkable without trusting the vendor: reused, familiar templates push click rates down because employees learn to recognize the exercises, without necessarily being better prepared for unfamiliar attacks ^[14].

Credential leaks fell about 1.5 times as fast as clicks between month six and month 12 ^[22]. Reporting also declined in that window ^[13]. Reports per click improved about 11% across those two stages ^[19], and that improvement comes from clicks falling faster than reports did. The larger ratio figure quoted at the 12-month stage is measured from three months, a longer stretch than the decline percentages cover ^[4].

The departmental figures count users, not messages. They are annual user-level measures: the share of users who clicked or submitted credentials at least once during the analysis year ^[16]. On that basis Construction's credential leak rate is about 40% of its click rate ^[12], the highest pair of departmental figures in the dataset ^[1]. Health clicked comparatively little and reported least of any named department, at 13.17% ^[17]. Logistics reported at 17.11%, below average, with an above-average click rate ^[18]. Pistachio notes that a reported message gives the security team the chance to investigate and remove similar mail from other inboxes ^[20].