How to turn your phishing and smishing simulation results into targeted training action.
The most effective approach is simple: test, measure, train, and reinforce. Your simulation results show exactly where your organization is vulnerable and who needs help.
Before making any training decisions, know what your numbers say about user behavior and risk.
Click-through rate
How many users clicked on a phishing link
Credential submission rate
How many users entered passwords or other data
Reporting rate
How many users flagged the simulation as suspicious
Repeat offenders
How many users have failed multiple simulations
The key question to ask: Who is struggling the most, and where is risky behavior concentrated?
Focus first on:
Individuals who have failed more than once
Teams with higher failure rates or lower reporting rates
Users who submitted credentials
Check which simulation types had the highest failure rates, then match your training response to the behavior you observed.
Assign mandatory training on the specific failure type within 48 hours
Send a brief reminder about how to spot the relevant red flags
Re-test with a similar simulation in 1–2 weeks
If failures continue, escalate to their manager
For everyone who clicks, focus on teachable moments. Send a short 8–10 step training module immediately while the experience is still fresh — just-in-time training is more effective than waiting days or weeks.
Share results directly with the department leader
Maintain regular quarterly training on emerging threats
Keep simulations varied so users don't become complacent
Recognize good reporters publicly where it fits your culture
In Herd: Link a training module to your simulation so failures automatically trigger enrollment. Use the dashboard or Herd AI to pull click rate, report rate, and credential submission stats by campaign or team.
Click rate trending down
Keep doing what you're doing
Click rate stuck or rising
Shift more training toward the simulation types causing the most failures
Same people failing repeatedly
Move to direct intervention or involve their manager
Every simulation is a chance to change behavior, strengthen your reporting culture, and steadily reduce real-world phishing risk. The results tell you exactly where to focus — all that's left is acting on them.
Last updated
