Phishing click rate
Phishing click rate is the percentage of a defined audience recorded as clicking a phishing link within a set period. How you count deliveries, repeat clicks, and automated visits affects the result.
Count people consistently
For a simulation with one message per person, you can calculate:
Click rate = unique recipients recorded as clicking ÷ unique recipients who received the message × 100.
If 12 of 200 recipients click, the rate is 6%. Count each person once, not each click, and use a stated observation window. This example uses successful deliveries as the denominator; check whether your platform uses deliveries, targeted users, or another basis.
Keep failed deliveries separate. Also say how automated activity was handled. A rate based on unfiltered events should not be presented as confirmed human behavior.
A recorded click may come from a security tool
Mail inspection and other security software can visit simulation links. Microsoft’s FAQ specifically warns that security applications and automated response workflows can create unexpected click or compromise events.
Investigate suspicious event patterns before attributing a click to an employee. Several clicks immediately after delivery warrant a closer look, but timing alone does not prove that a scanner caused them. Use the platform’s supported investigation and filtering guidance, and leave unresolved events identified as such.
A click is one step
Clicking is not the same as entering credentials, granting an application permission, or losing an account. A person can also click and then report the message. Keep those outcomes separate.
NIST’s Phish Scale helps interpret results in light of message difficulty and its relevance to the audience. A lower click rate on an easier exercise is not, by itself, evidence of improvement. Nor is a campaign’s click rate a person’s probability of causing a breach.
The awareness measurement article explains why these observations need to sit alongside checks of the processes people use.