Phishing report rate
Phishing report rate measures the proportion of a defined audience that reports a phishing message through the reporting channels your measurement captures, within a stated period.
Say what you counted
For a simulation with one message per person, a useful calculation is:
Report rate = unique recipients who reported the simulation ÷ unique recipients who received it × 100.
Use the same campaign and observation window for both counts. Count a person once even if they report twice. For example, 30 reporting recipients out of 200 who received the message gives a 15% report rate. That is a worked example, not a benchmark.
This is a measurement choice, not a formula every vendor follows. A dashboard may use targeted users rather than successful deliveries. Check its definition before comparing results. For real attacks, the full exposed audience may be unknown, so a percentage may be harder to support than a count of reports.
Reporting and recognition are different
Someone can recognize a phish and delete it without reporting. Someone else can click, realize something is wrong, and then report. A report rate does not tell you which happened unless you also examine the other events.
The reporting channel matters. Microsoft documents that reports made through non-Microsoft tools are not captured in its attack simulation reports. A person may have contacted security even when the simulation dashboard shows no report. Check whether the reporting routes employees actually use are measured.
When comparing exercises, account for message difficulty and audience context. NIST’s Phish Scale helps with that interpretation. An easier message can produce a different result without proving that the training improved.
Security Awareness Needs Evidence Beyond Completion puts reporting alongside the other behaviors an awareness program needs to understand.