Glossary
What is click rate in phishing simulations?
In a phishing simulation, the share of recipients who clicked the link (or opened the attachment or scanned the code). Useful as a trend, misleading on its own.
How it works
Click rate is the number of people who clicked divided by the number who received the simulation. It depends heavily on how hard the scenario was, so two campaigns’ click rates are only comparable if the lures were similar. Pair every rate with its counts.
A real example
The UK NCSC notes that simulations are popular because they appear to give clear numbers, but warns that metrics express an organisation’s values: if you seem to value the absence of problems, people keep quiet. It advises measuring how many people reported a phishing email as well as how many clicked.
How to use it
- Track the trend across campaigns, not a single result.
- Note the scenario and difficulty next to each figure.
- Read click rate together with report rate and lesson completion.
SecurityRing reports show who was tested, who clicked and who completed the lesson, with an executive trend report across campaigns.
Sources
Every clause, incident and figure above comes from these official or original sources.
- UK National Cyber Security CentrePhishing attacks: defending your organisationAccessed 17 October 2026.