Your IT Guy's Phishing Test Is Probably Making Things Worse

By Dan J, Founder of PhishPlease

Do your employees dread your phishing simulations, resent the person running them, or hide their clicks instead of reporting them? Then your testing program is making your company less safe. Not less trained. Less safe. Breaches live in the gap between those two.

I've seen this pattern so many times I could narrate it in my sleep like a nature documentary. A company decides to do something about phishing. Usually their insurer asked, or someone read a breach headline that made their arsehole clench. Someone in IT finds a simulation tool and crafts the most devious phishing email they can think of. They send it to the whole company on a Monday morning, with the giddy energy of a kid who has lit a firework in a bin. Fourteen people click. IT sends a company-wide email naming who failed. Now half the company resents IT and the other half is too scared to open anything. Nobody is any better at spotting phishing than before the circus started.

The 5 ways most phishing tests go wrong

1. Starting with an impossibly hard simulation

You wouldn't put a first-time driver in a Formula 1 car at Silverstone and act bewildered when they hit the barrier. Yet that's how most companies run their first phishing test. They send the hardest possible simulation, cold, to a team that's never had training. Then they panic when 40% click. KnowBe4's 2025 benchmarking report found the global average baseline click rate before any training is 33.1%. One in three employees everywhere clicks before training. Blaming your team for that is like pushing someone off a boat and writing them up for not swimming.

The fix: Start moderate. Detectable red flags, not insultingly obvious. Increase difficulty gradually over months.

2. Testing without any prior communication

Some companies send simulations to employees who've never been told what phishing is, or that simulations happen at all. That's like slapping someone across the face and handing them a leaflet about conflict resolution. Research from ETH Zurich at the NDSS 2025 symposium found deceptive simulation tactics cause significant backlash and long-term trust damage. Resentful employees don't report suspicious emails to IT. They quietly delete them and add another reason to update their CV. That's not a security culture. That's a mutiny incubating in slow motion.

The fix: Tell your team simulations are part of the security program before you start. They don't need to know when or what. They should know why.

3. Using it as a gotcha

Public leaderboards of who clicked. Results tied to performance reviews. Managers pulling people into meetings about their "security awareness deficiency", like a disciplinary hearing for a crime nobody knew was illegal. All of it teaches one reaction to a bad click. Not "I should tell IT", but "shit, I need to bury this deeper than a mob informant in the Nevada desert."

In security, that instinct is catastrophic. Compare "reported within 5 minutes" with "discovered 2 weeks later". By then the attacker has camped in your email like a squatter who's redecorated and changed the locks. The first is a nosebleed. The second is internal bleeding that kills you while you're still walking around feeling fine. Harvard research across 5,400 employees found punitive measures produced no statistical improvement. Punishment teaches people to hide mistakes, with the frantic desperation of a teenager clearing their browser history.

The fix: Keep individual results private. Celebrate team-level trends, not individual failures.

4. Simulations that are laughably fake

Emails from "Amaz0n", in grammar that suggests someone threw a dictionary into a blender. Your team spots them instantly and the click rate comes back at 2%. Leadership declares the company "phishing-resilient", with the swagger of a bloke who beat his 8-year-old at chess and now reckons he could take on Magnus Carlsen.

Real phishing in 2026 is written by AI. Verizon's DBIR noted AI-written malicious emails have doubled in two years. These emails are grammatically flawless and personalized. Training against cartoon fakes and expecting your team to catch AI phishing is like preparing for a cage fight by wrestling an inflatable clown.

The fix: Use templates based on real attack patterns. If a simulation wouldn't make you pause for at least a second, it's too easy.

5. Running simulations once or twice a year

Annual phishing tests are compliance theater. They make the audit trail look good and do as much for your security as a chocolate padlock on a bank vault. KnowBe4's data shows click rates drop 40% in 90 days of consistent training, and 86% after 12 months. That takes ongoing exposure. Once a year doesn't change behavior. Skills you don't practice rot, like food at the back of a fridge that everyone ignores until it starts to smell.

The fix: Monthly simulations. Vary templates, difficulty and attack type. Consistency beats complexity.

The metric everyone gets wrong

Most companies measure success by click rate alone. Click rate is only half the picture.

The metric that shows whether your security culture works is report rate. Faced with a suspicious email, someone can click it (bad), ignore it, or report it. Ignoring it is the security version of hearing a strange noise at 3am and pulling the covers over your head. The email is still sitting in everyone else's inbox, a landmine your whole team walks past every morning. Reporting it means IT can warn everyone, block the sender and contain the damage before it spreads like a rumour at a school reunion.

Hoxhunt's 2025 data found that before training, only 34% of users report simulated phishing. After 12 months, that climbs to 74%. Compare two teams with a 15% click rate. One reports 5% of phishing emails. The other reports 40%. The second team is in far better shape, because it's catching threats and shouting for help. The first is quietly bleeding out, like a dinner party where the host is clearly having a breakdown and nobody says a word.

If your program doesn't measure report rate, you're optimizing for the wrong thing. You're teaching people to fear clicking instead of to report fast. Fear makes people hide mistakes, with the panic of someone flushing evidence during a police raid. That's the last thing you want when an attacker is elbow-deep in your company's email.

What to do instead

The loop is simple: Simulate, Catch, Teach, Repeat. Send realistic simulations. When someone clicks, show them what they missed and give them a 2-minute lesson. Track click rates AND report rates. Celebrate improvement. Do it monthly.

The culture is simpler: Train, don't shame. Tell people simulations exist because phishing is how most breaches start. Reward reporting. Make it clear that clicking a simulation and reporting it straight away is a win. That "report it fast" reflex is what saves companies in a real attack.

I spent 3 years at Duo watching how enterprise companies handle security. The ones with the strongest posture don't have the lowest click rates. Their employees feel safe saying "I think I clicked something dodgy." In a real breach, the 30 seconds between "I clicked something bad" and "IT knows" are worth more than a year of flawless simulation scores gathering dust in a compliance folder.

That's why I built PhishPlease the way I did. Monthly simulations, immediate feedback, 2-minute lessons, no gotcha bullshit. We're the good bad guys. We trip your people up so real attackers can't, and we do it without making your team want to key your car in the car park.

The bar for small business security is so low it's a tripping hazard in hell. If you run simulations at all, even imperfectly, you're ahead. The gap between going through the motions and changing behavior is the gap between a program built on fear and one built on practice. Close it, and you've dealt with the weakness behind 60% of breaches. That door is either reinforced with steel bolts or propped open with a neon WELCOME sign, a red carpet and a complimentary drink on arrival.