A click rate in isolation tells you almost nothing. The real value of a twelve-month phishing simulation programme is what it reveals about reporting behaviour, departmental risk distribution, the speed at which people learn, and whether your security culture is actually changing or just performing compliance.
Most Australian organisations run phishing simulations quarterly, review the click rate, and conclude the programme is working. The metric is real. The conclusion it supports is not. An organisation with a 10% click rate and a 2% reporting rate has a more dangerous security culture than one with a 15% click rate and a 25% reporting rate. The first group clicks less but notices nothing. The second group clicks more but most of them report it.
The Three Metrics That Actually Matter
Click rate is the percentage of employees who clicked the simulated phishing link. It is a baseline measure of susceptibility, useful for trending over time. By itself it is a snapshot of how many people fell for a specific lure on a specific day.
A high reporting rate is one of the strongest indicators of a healthy security culture. Reporting rate tracks the percentage of employees who actively flag the simulated phishing attempt rather than deleting it. A rising reporting rate, even if click rate is unchanged, indicates the programme is producing the behavioural outcome that matters most in a real attack: rapid identification and escalation. For ISO 27001 Annex A 6.3 compliance, documented improvement in reporting rate is substantially stronger evidence than click rate alone. The reporting rate is also the metric that is hardest to fake: a team that genuinely recognises phishing attempts will report them even when unprompted.
Credential submission rate is the third and most consequential metric. An employee who enters credentials on a fake login page has handed an attacker the material to initiate a genuine breach. The credential submission rate by department and role level identifies which population segments represent the highest human risk for an attacker who has reached their inbox. A high credential submission rate in the finance or IT department is a higher-priority risk signal than the same rate in any other population.
Beyond Email: Why Multi-Vector Campaigns Change What the Test Finds
The 2024-25 ACSC Annual Cyber Threat Report noted that malicious actors use stolen personal information to embed realistic organisational context into lures. A simulation programme that only tests email is preparing employees for part of the attack surface.
Voice phishing (vishing) simulates inbound calls from a fake supplier, IT helpdesk, or executive requesting urgent action. Vishing bypasses the visual cues email phishing training covers and tests a different vulnerability: the authority pressure of a live voice call.
SMS phishing (smishing) reaches employees on the same device they use for MFA. For ANZ financial services with staff authorising transactions by mobile, smishing is the closest simulation to the actual business email compromise attack. Real attackers do not limit themselves to email. Rotating across email, SMS, and voice phishing gives a substantially more accurate view of organisational human risk than email testing alone.
Your Last Pentest Is Already Out of Date
Every week you ship without continuous testing is a week a vulnerability goes unseen. See what Capture The Bug finds in your first engagement.
Phishing Simulation vs Social Engineering Red Team
A phishing simulation tests population-level susceptibility and produces click rate, reporting rate, and credential submission data over time.
A social engineering red team is objective-driven and targeted. Using OSINT on specific individuals, the red team crafts spear-phishing or vishing scenarios tailored to the target's role and attempts to achieve a defined objective: credential theft, physical access, or business process manipulation. The output is an attack narrative, not a click rate.
Social engineering testing supports compliance with ISO 27001, PCI DSS, and the Australian ISM by demonstrating that personnel awareness and response capability are monitored and improved. The guide to red team vs penetration testing for ANZ CISOs covers how each engagement type fits the broader security assurance programme.
AU Compliance: APRA, ISO 27001, and the ISM
APRA CPS 234 paragraph 18 requires APRA-regulated entities to maintain information security capability commensurate with the size and extent of threats. A phishing simulation programme with measured outcomes is strong evidence for this control. ISO 27001 Annex A control 6.3 requires information security awareness training. Auditors reviewing ISO 27001 certification look for a programme showing trending improvement, not a point-in-time click rate.
For how phishing simulation evidence connects to the broader testing evidence trail that APRA and ISO 27001 auditors check, the guide to what happens after a penetration test covers how each testing engagement produces regulatory evidence.
Run simulations monthly, not quarterly. Monthly cadence builds habit rather than compliance snapshots. Twelve monthly simulations with rotating lure types and multi-vector delivery produces evidence that auditors accept as a genuine awareness programme.
Book a consultation with Capture The Bug to scope a social engineering testing programme aligned to your AU compliance requirements, sector threat profile, and current phishing simulation baseline.
Plan Your Annual Pentesting Strategy the Right Way
Learn how modern SaaS companies structure pentesting across the year to reduce risk, stay compliant, and avoid last-minute panic before audits.
Frequently Asked Questions
What does a phishing simulation actually measure in Australia?
A phishing simulation measures three behavioural metrics: click rate (percentage of employees who clicked the simulated link), reporting rate (percentage who actively flagged the suspicious email), and credential submission rate (percentage who entered credentials on a fake login page). Click rate alone is the weakest indicator of security culture. A rising reporting rate over time is the strongest indicator that the awareness programme is producing the behavioural change that matters in a real attack: rapid identification and escalation.
What is the difference between a phishing simulation and a social engineering red team?
A phishing simulation tests population-level susceptibility using standardised lures across the organisation and produces click rate, reporting rate, and credential submission data over time. A social engineering red team is objective-driven and targeted: the red team uses OSINT research on specific individuals, crafts spear-phishing or vishing scenarios specific to the target's role and activity, and attempts to achieve a defined objective such as credential theft or business process manipulation. The output is an attack narrative showing what was done, what the target did, and what access was gained.
Does APRA CPS 234 require phishing simulation for Australian financial institutions?
APRA CPS 234 paragraph 18 requires APRA-regulated entities to maintain information security capability commensurate with the size and extent of threats. A phishing simulation programme with documented outcomes is strong evidence for this control. While paragraph 18 does not specify phishing simulation by name, APRA supervisors examining an entity's security awareness programme expect to see measured outcomes and trending improvement, not just policy statements about training.
How often should Australian organisations run phishing simulations?
Monthly simulation builds habit in a way that quarterly testing does not. An organisation running twelve monthly simulations with rotating lure types and multi-vector delivery produces compliance evidence that ISO 27001 and APRA auditors accept as a genuine awareness programme. Quarterly testing produces snapshots. Monthly testing produces trend data that reveals whether the programme is changing behaviour or only testing it.
What is vishing and why should it be included in ANZ phishing simulation?
Vishing is voice phishing: simulated inbound calls from a fake supplier, IT helpdesk, or executive requesting urgent action. Vishing bypasses the visual cues that email phishing training covers and tests a different vulnerability: the authority pressure of a live voice call. For ANZ financial services organisations, vishing is especially relevant because it simulates the social engineering component of business email compromise fraud, where an attacker calls to confirm or authorise a fraudulent transaction initiated by email.
