Measuring phishing click-through without lying to yourself
A 2% click rate on a cartoonish lure is not the same as 2% on a real invoice.
ITSIGN Administrator · June 18, 2025 · 2 min read
Match difficulty to the real threat. Track report rate as hard as click rate. Do not reset the year and call it improvement if you made the lures easier.
Share the graph with leadership. Not the names.
That reporting is part of security awareness training.
Related reading
Awareness training for hybrid and remote teams
Home routers, family PCs, and coffee-shop Wi-Fi are part of your estate whether you like it or not.
2 min read
Building a report-it culture
The best control you do not have to licence: staff who forward the weird mail in under two minutes.
2 min read
Why the annual security video fails
People click complete. Attackers do not wait for your LMS calendar.
2 min read
Want this applied to your environment?
A short conversation, an honest assessment of your current setup, and a clear proposal. No obligation and no pressure.