--- title: "Are phishing simulations conducted for all employees, with click rate tracking?" url: https://insuranceposture.com/questions/email-security/phishing-simulations-conducted-employees-click-rate-tracking category: "Email security and phishing" canonical_key: q_eml_005 evidence_state: partial updated: 2026-08-24 --- # Are phishing simulations conducted for all employees, with click rate tracking? URL: https://insuranceposture.com/questions/email-security/phishing-simulations-conducted-employees-click-rate-tracking Section: Email security and phishing Evidence state: Partly verifiable from your tenant Click rate is the metric everyone reports. Reporting rate is the metric that predicts whether an actual campaign gets caught in the first ten minutes. ## What the carrier is actually asking The carrier is asking whether simulated phishing is run against the whole workforce on a regular basis and whether results are measured. Some forms ask for the current click rate, which turns this into a number you will be held to. ## Why it is underwritten Phishing remains the leading initial access vector, and simulation is the only way to measure susceptibility rather than assume it. Carriers use the click rate as a proxy for workforce risk and the existence of a programme as a proxy for security culture. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Simulation platforms hold the results. Microsoft 365 includes attack simulation training at the appropriate plan level, which makes the programme visible in the tenant when that is what you use. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Microsoft 365 | Attack simulation training campaigns and results | Campaigns run across the full user base, with results retained over time | | Simulation platform | Campaign history, coverage, click rate, and reporting rate | Regular cadence, full coverage, and both metrics tracked. Attested where a third-party platform is used | | Microsoft 365 | Report-phishing telemetry during simulations | Reporting rate captured, which is the metric that predicts real detection speed | | Training platform | Follow-up training assignment and completion for those who clicked | A defined consequence path, which the next question asks about directly | | Programme records | Difficulty progression across campaigns | Increasing sophistication over time, since repeating an easy template produces an improving number and no improving behaviour | **An improving click rate can be an artefact** If the templates stay easy and the audience learns the sender address, the number improves while susceptibility does not. Underwriters have started asking about template difficulty for this reason. A stable click rate against increasingly difficult templates is a better result than a falling one against the same template. ## What a defensible yes requires - Simulations run on a regular cadence across the whole workforce, including executives and contractors. - Both click rate and reporting rate are tracked over time. - Template difficulty increases, so the measurement stays meaningful. - Those who click receive follow-up training promptly. - The reported figure is current and matches your platform, since it may be checked at claim time. ## How this answer goes wrong The programme covers office staff and omits the populations that matter most: executives, finance, and contractors with mailboxes. Or the reported click rate is the best result the programme ever produced rather than the current one. Carriers do occasionally ask for the platform report, and a mismatch is difficult to explain. ## If this answer turns out to be wrong Business email compromise is the highest-frequency cyber claim, so the mail controls described on the application are among the first things an adjuster reads back against it. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what counts as misrepresentation on a cyber application](https://insuranceposture.com/glossary/misrepresentation). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### What click rate is acceptable? Single digits reads well and is heavily dependent on template difficulty, which makes cross-organisation comparison unreliable. Trend and coverage matter more than the absolute figure. ### How often should we run them? Quarterly is the common cadence, with monthly for high-risk groups. Annual is generally too infrequent to change behaviour. ### Should executives be included? Especially executives. They are the targets of the most valuable attacks and are exempted from simulations more often than any other group. ### Is reporting rate really more useful? For predicting real outcomes, yes. A campaign detected because three people reported it within minutes is contained; a campaign where nobody clicked and nobody reported it is still running. ## Related questions - [How does the Applicant handle repeat offenders/clickers in phishing simulations?](https://insuranceposture.com/questions/email-security/applicant-handle-repeat-offenders-clickers-phishing-simulations) - [Does the Applicant have a report-phishing email add-in enabled for all email users?](https://insuranceposture.com/questions/email-security/applicant-report-phishing-email-add-enabled-email-users) - [Are employees with financial/accounting responsibility given social engineering and phishing training?](https://insuranceposture.com/questions/email-security/employees-financial-accounting-responsibility-given-social-engineering-phishing-training) - [Does the Applicant employ mandatory annual InfoSec/privacy training for employees and contractors?](https://insuranceposture.com/questions/governance-and-workforce/applicant-employ-mandatory-annual-infosec-privacy-training-employees-contractors) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.