How to Run a Phishing Test and What to Measure
A phishing test sends a simulated deceptive message to your own people to see how they respond, then uses the result to coach them. Done well, it measures decisions rather than catches people out: the goal is a safer response next time, not a gotcha.
Setup
A useful test starts before anything is sent:
- Define what decision you are rehearsing: a payment, a credential entry, an approval, a download.
- Build the scenario from real business context so it is a fair test, and have a human review and approve every message.
- Agree the escalation path: what happens when someone reports, clicks, or enters credentials.
- Tell leadership and HR what is running and why, so the program is seen as coaching, not surveillance.
Metrics
Click rate alone is a weak number. A result only means something when you know how hard the test was:
- Report rate: how many people reported the message, and how fast. This is the habit you want to grow.
- Interaction depth: opened, clicked, entered data, approved. Each step is a different risk.
- Difficulty-adjusted results: compare people against tests of similar sophistication, not against a flat average.
- Trend per person: is the same individual improving over successive tests?
Follow-up training
The test is the input; the coaching is the outcome. The moment someone interacts with a simulation is the moment they are most open to learning. Deliver a short, specific explanation of the cues they missed, then assign role-relevant training. The next test should adapt to what each person actually needs to practice.
Clarity before
the next step.
How often should you run phishing tests?
Regularly enough that verification stays a habit, typically monthly or more, with scenarios that adapt so people cannot learn the pattern of the test itself.
Should employees know a test is coming?
Tell them the program exists and why; do not announce specific sends. The point is to rehearse an everyday decision, not to trick anyone.
What is a good phishing test result?
A rising report rate and falling interaction depth over time, measured against the difficulty of the tests sent. A single click rate without context says little.