How to Tell If Your Security Training Is Working
Learn how to measure security training effectiveness and why click rates don't tell the whole story.
Every security awareness programme eventually faces the same question: is it working?
For many teams, the answer starts and ends with the click rate: if it is falling, the programme is working. But in a structured programme, the click rate does not simply slide downwards and reading it that way can tell you the opposite of what is happening.
We analysed a year of phishing behaviour across 123,692 employees in SMB and mid-market organisations. The clearest takeaway was about the shape of the journey, not any single number.
Security awareness is a journey, not a straight line
In the organisations we looked at, click and leak rates did not fall steadily from day one. They climbed through the first half of the year, reached their highest point around the six-month stage, then fell. By twelve months, both sat well below the peak.
Check a programme at six months and you would see the numbers rising, and conclude it was failing. Look at the same one over the full year and you would see a very different trajectory. Same programme, opposite verdicts, depending only on when you looked.
Why a good programme's numbers can rise
The rise is not necessarily a sign of failure. It is a sign the testing is getting harder.
A structured programme does not send the same easy simulations on repeat. It increases the frequency and difficulty of tests over time, and the six-month stage is where that pressure peaks: people receive more simulations, and a higher share of difficult ones, than at any other point. More testing, and tougher testing, exposes more people to a test they are likely to fail at least once.
The numbers can increase because the programme is surfacing risk that was already there, rather than because people are becoming less resilient. A gentler programme would have left that risk undisturbed and produced a lower, more flattering number, while changing nothing about how exposed the business really was.
Read the trend, and read it against difficulty
This is why a single click rate, on its own, tells you so little. Two things give it meaning:
Time. Judge the direction of travel across the programme, not a single stage, and treat a mid-programme rise as a question worth asking rather than a verdict.
Difficulty. A click rate falling against tests that never change tells you people have learned the format. A click rate falling while the tests stay hard tells you people are improving.
What a working programme looks like
A programme that is working should leave people more resilient to phishing at the end of the year than they were at the start, even if the middle looked worse.
Security awareness is continuous, and so is the picture of whether it is working. The honest way to see it is over time, in context, and especially not from the hardest moment alone.
Download the full Phishing Behaviour Report 2026 to see the complete 12-month journey, and where your sector and teams sit along it.
Want to see what continuous measurement looks like in practice? Email contact@pistachioapp.com to book a 15-minute demo.
We believe in a learn-by-doing approach over snooze-worthy videos.
Instead, Pistachio tailors real-world scenarios so your team can build their cyber skills in a safe environment.
Continue reading
Ready to reduce your human risk? Book your demo today.
“We lacked confidence that employees would recognise today’s phishing threats or respond correctly. Since using the Pistachio platform, they are more attentive and proactive in identifying potential risks. The solution is easy to manage, quick to implement, and highly effective.
“The platform is easy to implement and provides clear insights into employee phishing awareness. Its bite-sized learning encourages participation, saves administration time, and allows us to focus more on real threat detection.”
“We were looking for a practical way to improve cybersecurity awareness across the organization. Pistachio made training simple and engaging, and we’ve seen a noticeable improvement in employee awareness with minimal effort.”
“Pistachio removed the burden of planning campaigns, collecting data, and evaluating results. The program challenges each employee at their own level and provides clear, simple reporting. Pistachio has streamlined our awareness training and strengthened our organization’s cybersecurity.”
“Our goal was to help employees better recognize phishing emails and avoid malicious links. Pistachio made this easy and engaging, and we’ve seen a clear improvement in detection, fewer clicks on phishing links, and reduced data disclosure. With minimal ongoing maintenance, it’s an effective and low-effort solution.”
“Within weeks, Presence had flagged several incidents that could have otherwise been missed, including employees forwarding company data to personal accounts during offboarding. The alerts are reliable and actionable, so we've built a full investigation process around them. Although I was skeptical at first, the value was obvious almost immediately.”
“Pistachio has reduced our manual workload to zero with its automated phishing simulations and in‑box delivery of scenario‑based trainings. This has allowed our team to dedicate time to other important security initiatives while Pistachio handles our Security Awareness program seamlessly.”
“Presence automatically detects suspicious behaviour and gives us the visibility we need without constant manual oversight. Within the first few weeks we were already seeing alerts that would have otherwise gone unnoticed as the system learns what is usual and unusual behaviour for our environment.”
“Before Pistachio, security awareness was something we could only offer to a few customers. Today it’s part of every managed service we deliver, and we haven’t had to grow the team to make that happen.”
Fill out the form to book a demo:
Trusted by 1200+ customers & MSPs
