Are phishing simulations conducted for all employees, with click rate tracking?
Click rate is the metric everyone reports. Reporting rate is the metric that predicts whether an actual campaign gets caught in the first ten minutes.
What the carrier is actually asking
The carrier is asking whether simulated phishing is run against the whole workforce on a regular basis and whether results are measured. Some forms ask for the current click rate, which turns this into a number you will be held to.
Why it is underwritten
Phishing remains the leading initial access vector, and simulation is the only way to measure susceptibility rather than assume it. Carriers use the click rate as a proxy for workforce risk and the existence of a programme as a proxy for security culture.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Simulation platforms hold the results. Microsoft 365 includes attack simulation training at the appropriate plan level, which makes the programme visible in the tenant when that is what you use.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Microsoft 365 | Attack simulation training campaigns and results | Campaigns run across the full user base, with results retained over time |
| Simulation platform | Campaign history, coverage, click rate, and reporting rate | Regular cadence, full coverage, and both metrics tracked. Attested where a third-party platform is used |
| Microsoft 365 | Report-phishing telemetry during simulations | Reporting rate captured, which is the metric that predicts real detection speed |
| Training platform | Follow-up training assignment and completion for those who clicked | A defined consequence path, which the next question asks about directly |
| Programme records | Difficulty progression across campaigns | Increasing sophistication over time, since repeating an easy template produces an improving number and no improving behaviour |
If the templates stay easy and the audience learns the sender address, the number improves while susceptibility does not. Underwriters have started asking about template difficulty for this reason. A stable click rate against increasingly difficult templates is a better result than a falling one against the same template.
What a defensible yes requires
- Simulations run on a regular cadence across the whole workforce, including executives and contractors.
- Both click rate and reporting rate are tracked over time.
- Template difficulty increases, so the measurement stays meaningful.
- Those who click receive follow-up training promptly.
- The reported figure is current and matches your platform, since it may be checked at claim time.
How this answer goes wrong
The programme covers office staff and omits the populations that matter most: executives, finance, and contractors with mailboxes. Or the reported click rate is the best result the programme ever produced rather than the current one. Carriers do occasionally ask for the platform report, and a mismatch is difficult to explain.
Frequently asked
What click rate is acceptable?
Single digits reads well and is heavily dependent on template difficulty, which makes cross-organisation comparison unreliable. Trend and coverage matter more than the absolute figure.
How often should we run them?
Quarterly is the common cadence, with monthly for high-risk groups. Annual is generally too infrequent to change behaviour.
Should executives be included?
Especially executives. They are the targets of the most valuable attacks and are exempted from simulations more often than any other group.
Is reporting rate really more useful?
For predicting real outcomes, yes. A campaign detected because three people reported it within minutes is contained; a campaign where nobody clicked and nobody reported it is still running.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture