Use Simulation Results to Decide Your Next Training

How to turn your phishing and smishing simulation results into targeted training action.

The most effective approach is simple: test, measure, train, and reinforce. Your simulation results show exactly where your organization is vulnerable and who needs help.

1. Understand Your Metrics

Before making any training decisions, know what your numbers say about user behavior and risk.

Metric	What It Measures
Click-through rate	How many users clicked on a phishing link
Credential submission rate	How many users entered passwords or other data
Reporting rate	How many users flagged the simulation as suspicious
Repeat offenders	How many users have failed multiple simulations

The key question to ask: Who is struggling the most, and where is risky behavior concentrated?

---

2. Identify Who to Prioritize

Focus first on:

• Individuals who have failed more than once

• Teams with higher failure rates or lower reporting rates

• Users who submitted credentials

---

3. Act on Results

Check which simulation types had the highest failure rates, then match your training response to the behavior you observed.

Individuals Who Failed

• Assign mandatory training on the specific failure type within 48 hours

• Send a brief reminder about how to spot the relevant red flags

• Re-test with a similar simulation in 1–2 weeks

• If failures continue, escalate to their manager

For everyone who clicks, focus on teachable moments. Send a short 8–10 step training module immediately while the experience is still fresh — just-in-time training is more effective than waiting days or weeks.

High-Risk Departments

• Share results directly with the department leader

• Maintain regular quarterly training on emerging threats

• Keep simulations varied so users don't become complacent

• Recognize good reporters publicly where it fits your culture

In Herd: Link a training module to your simulation so failures automatically trigger enrollment. Use the dashboard or Herd AI to pull click rate, report rate, and credential submission stats by campaign or team.

---

4. Monitor Trends Over Time

Trend	What to Do
Click rate trending down	Keep doing what you're doing
Click rate stuck or rising	Shift more training toward the simulation types causing the most failures
Same people failing repeatedly	Move to direct intervention or involve their manager

---

Summary

Every simulation is a chance to change behavior, strengthen your reporting culture, and steadily reduce real-world phishing risk. The results tell you exactly where to focus — all that's left is acting on them.