Interpreting Your Results
Interpreting Your Results
Overview
Raw numbers only have value when you know how to read them. This guide explains what PhishGrid campaign metrics mean and what actions they should trigger.
Key metrics explained
| Metric | What it measures |
|---|---|
| Phish rate | % of targets who clicked the simulation link — core vulnerability measure |
| Report rate | % of targets who flagged the simulation — security culture indicator |
| Send rate | % of emails delivered — if low, check whitelisting |
| Submission rate | % who entered data on a landing page — highest risk indicator |
Industry benchmarks (approximate)
| Metric | Strong | Needs improvement | Critical |
|---|---|---|---|
| Phish rate | < 5% | 5–20% | > 20% |
| Report rate | > 20% | 5–20% | < 5% |
| Training completion | > 90% | 70–90% | < 70% |
Common patterns and what they mean
High click rate + low report rate Users are both vulnerable and not reporting. Prioritise: basic awareness training + heavy promotion of the report button.
Low click rate + low report rate Users aren't clicking but also aren't reporting — they're deleting suspicious emails. Better than clicking, but the reporting culture is missing. Focus on the report rate.
100% click rate Almost certainly a false positive from automated link scanning. Check bot detection settings and whitelisting. See the Bot Detection doc.
High click rate in one specific group That group has a targeted gap. Run a focused campaign with relevant templates and assign group-specific training.
Plateau after initial improvement Normal — the easy gains come first. Increase template difficulty or introduce new attack vectors (vishing, SMS, spear phishing).
The click-to-report ratio
For every user who clicked, how many reported? This single ratio best captures programme maturity.
| Ratio | Meaning |
|---|---|
| 10:1 or worse | Strong awareness gap — urgent action needed |
| 5:1 | Typical starting point |
| 2:1 | Good momentum |
| 1:1 or better | Excellent security culture |
Actions by result
| Result | Immediate | Within 1 week |
|---|---|---|
| Phish rate > 20% | Alert team lead; assign training | Follow-up campaign |
| Phish rate 5–20% | Assign training to clickers | Monitor next campaign |
| Report rate < 5% | Promote report button | Training on reporting |
| Specific group outlier | Notify group manager | Targeted campaign |