Reporting a quarterly click rate to leadership feels like progress. It rarely is. The number moves with template difficulty, send time and which department was targeted, and it tells you almost nothing about whether people are safer.
The signal that matters is the report rate paired with the repeat-offender trend. A workforce that clicks less but also reports more is internalizing the behavior you want. A workforce with a flat report rate is just getting better at recognizing your templates.
Build campaigns around the teachable moment. The landing page a user reaches after a click should explain, in plain language, what the lure exploited and what the safe action was. Tie that back to the individual risk score so the same person sees their own trend, not an anonymous company average.