The phishing simulation has ended, and the report shows clicks, reports and training completion. A common next step is to send everyone the same course. Yet similar results may conceal different needs: finance staff verify supplier changes, HR teams routinely receive candidate attachments, and IT staff handle account and access requests. A simulation becomes useful when an observation leads to a specific behavior that people can practise and the organization can measure.

This article proposes a practical way to interpret results and build awareness around job roles. The matrix and measures below are operating suggestions to adapt to organizational policy, not a mandatory regulatory template or a description of product capabilities. Start with one question: what decision should the employee make more effectively when a similar message arrives?

Read the simulation context before comparing teams

A higher click rate does not establish that one department is less aware. The NIST Phish Scale considers message characteristics and how closely its premise matches the recipient’s work, providing context for clicks and reports. [1] A convincing, relevant payment message differs from an unrelated message. Record the scenario, audience and timing before presenting percentages.

Check data quality with the email team. Were messages delivered? Could link-scanning software have generated an event? Was one person counted repeatedly? Sending a message does not prove that the employee saw it. Document failed delivery, leave, shared mailboxes and exclusions, and preserve those definitions for later comparisons. If suspected automated activity cannot be separated, mark the click result as requiring verification rather than attributing it directly to an employee.

Show the size of the group and the number actually included in the exercise. Do not generalize a change in a small group to the whole organization, or combine different scenarios into a department league table. Explain changes in audience, scenario or measurement tool. A new baseline may be more appropriate than an apparent improvement percentage.

Select measures that reveal the behavior to improve

In the proposed measurement card, divide the number of people with verified human clicks by the number of recipients with confirmed delivery, within a defined observation window. For valid reporting, divide the number of people who report the simulated message through the approved channel by the same delivery denominator. Retain counts alongside rates and apply a documented rule for duplicates. These are proposed definitions; do not mix them with a different denominator supplied by a measurement platform.

Add the median time from delivery to each reporter’s first valid report, explicitly stating that this measure covers reporters only. Someone who never reports does not have a reporting time of zero; show non-reporters separately. A person may both click and subsequently report, so the two measures are not mutually exclusive. Record reporting after interaction to understand recovery behavior, without adding overlapping percentages.

Connect measurement to the actual task. Did the employee follow the supplier-bank-change verification process, pause before sharing information, or reach the correct reporting channel? Course completion demonstrates that an activity occurred; behavior requires a follow-up observation. Also inspect the team’s ability to handle reports. More reports accompanied by slower triage may reveal an operational issue alongside the training need.

Read rates alongside scenario difficulty, confirmed delivery, reporting and time before choosing an intervention.

Turn each gap into an intervention relevant to the role

Ask someone who understands the role which step failed, then select a short exercise that addresses it. Was the sender unclear, the reporting channel difficult, or the official verification process incomplete? The last issue also needs a process change. The matrix gives proposed examples to complete with actual observations, an owner and a date. It does not assume that everyone in a role has the same learning need.

Role and possible observation	Behavior and proposed intervention	Follow-up measure
Finance: accepting payment-detail changes from an email alone.	Independent verification through a known channel; practise the supplier-change process.	Verification rate in a comparable test.
HR: handling an unexpected attachment without verification or reporting.	Practise distinguishing expected attachments and using the approved verification and reporting route.	Valid reporting rate and time among reporters.
IT: responding to a privileged-access request without independent confirmation.	Practise requester verification, approval and escalation under the approved procedure.	Verification-process adherence before execution.
Leadership: responding to an urgent request outside normal authority.	A short decision exercise applying delegated authority and verification under time pressure.	Share of cases following authority and verification rules.

For each row, record the baseline, target behavior, intervention, owner, next assessment date and evidence source. Set success criteria before testing, informed by risk and available data; no universal percentage fits every organization. If employees understand the process but cannot follow it—for example, because no approved verification route exists—remove that obstacle before repeating the course.

A hypothetical example: better results still need interpretation

Suppose a simulation reaches 100 employees in a finance team. The team verifies 18 human clicks and 12 reporters, with a median reporting time of 40 minutes among reporters. Every number and time in this example is hypothetical. Review finds that independent verification of supplier-detail changes is unclear. The intervention therefore combines a clearer procedure with practice, rather than simply repeating a general course.

A later exercise reaches 100 recipients using a scenario as comparable as practicable in difficulty and context. There are 10 clicks and 25 reporters, with a median reporting time of 20 minutes. This is encouraging, but does not establish that training caused the change: different messaging, attendance or prior warnings may matter. Examine evidence that people followed the verification procedure and continue follow-up before claiming sustained improvement.

An awareness plan connects each role to an observable behavior, a specific intervention and a follow-up measure.

Preserve trust and make follow-up part of the program

NIST SP 800-50 Rev. 1 treats phishing exercises as learning opportunities and advises against punitive use or singling out employees. [2] Give individual feedback privately and show management patterns and actions rather than lists of names. Set access and retention rules for individual results under organizational policy. Welcome reporting after a mistake as a useful step in the response.

In Saudi Arabia, the NCA’s GECC–2:2026 implementation guide presents requirements for multichannel awareness, safe email and phishing handling, specialized training for relevant responsibilities, and periodic review under domain 1-10. [3] Apply requirements according to the organization’s scope. A single campaign or course-completion certificate does not demonstrate compliance.

Close each cycle with a short record: which gap was confirmed, what action was implemented, whether the follow-up was comparable, and what happens next. Separate training needs from policy or technical-control changes. Keep a record of changes to scenarios and metric definitions so that trends can be interpreted over time.

Start with awareness linked to your organization’s work

RMG offers Ameen, its cybersecurity awareness and phishing simulation system, with training-path and course management and employee-progress tracking. [4] Begin a discussion with RMG using an existing simulation’s results, the roles involved and the behavior you want to improve, then agree an appropriate awareness and follow-up scope. Contact RMG’s experts to translate simulation results into practical training priorities for your organization.