Phishing Study: Click Rates Mislead; Leaks and Reporting Better Metrics

A large-scale analysis of 2.47 million simulated phishing attacks challenges the conventional focus on click rates in security awareness testing. The research suggests organizations should instead measure credential leaks and user reporting behavior as more meaningful indicators of resilience. This could shift industry best practices for security training and assessment.