Glossary
What is report rate in phishing simulations?
The share of recipients who reported a phishing or simulated phishing message to the security team, including those who reported after clicking.
How it works
Report rate is the number of people who reported a message divided by the number who received it. Unlike click rate, higher is better: each report is an early warning that an attack got past filters.
A real example
The UK NCSC calls users who feel comfortable reporting a valuable early warning system. In a case study in its phishing guidance, 25 recipients reported an attack email, some after clicking, and that was the first sign it had got past the initial defences. The NCSC advises measuring reports alongside clicks, and making sure people know in advance how to report.
How to raise it
- Give people one simple way to report, such as a button in the email client.
- Thank reporters, including those who clicked first.
- Never punish someone for reporting a mistake.
Sources
Every clause, incident and figure above comes from these official or original sources.
- UK National Cyber Security CentrePhishing attacks: defending your organisationAccessed 17 October 2026.