# Do phishing simulations work? Why everyone's tired of those IT emails

> Tired of IT's anti-phishing emails? Large studies found phishing simulations barely reduce clicks. What the research says, and what to do instead.

Canonical: https://www.phishclean.com/blog/do-phishing-simulations-work
Last updated: 2026-11-05

November 5, 2026 - 5 min read

By PhishClean Research Team

If your school or office sends you fake phishing emails, then assigns a quiz, you're not alone in finding it pointless. The research is largely on your side, with a few caveats.

A thread on r/Teachers asked whether anyone else was tired of the IT anti-phishing e-mails, and it drew 71 comments. One complaint stood out: even if you just delete the email instead of reporting it, "they still make you take a quiz or pd about phishing." Teachers are not alone. Nurses, bank staff and office workers everywhere have the same complaint.

So is the annoyance at least buying some safety? The best evidence says: not much.

## The short answer from research

The clearest study comes from UC San Diego Health. Researchers ran an eight-month randomized controlled trial with ten simulated campaigns sent to about 19,500 employees, and presented it at IEEE Security and Privacy in 2025.

- **Annual training:** no significant relationship between having recently completed mandated training and falling for phishing.
- **Training shown after a failed test:** about a 2% reduction in the likelihood of clicking.
- **Attention:** 75% of people spent a minute or less on the training material, and a third closed it without engaging at all.

A 15-month study of more than 14,000 employees at a large company, by researchers at ETH Zurich, went further. It found that embedded training "does not make employees more resilient to phishing" and can have side effects that make them more susceptible. In its survey, 43% said that seeing the training page made them feel safe.

## The caveats

It wouldn't be fair to stop there. The ETH authors warn that their result applies to a specific voluntary delivery method, and that other approaches could produce different results. Follow-up work from the same group looked at content, nudges and incentives. UC San Diego is one health system, even if a very large one. And "barely reduces clicks in a simulation" isn't identical to "has no value at all". Tests can still show whether the report button works and how fast a security team reacts.

What the research doesn't support is the common assumption that a few tests and a quiz each quarter will train phishing out of a workforce.

## The hidden cost nobody budgets for

Simulations aren't free, even if the tool is cheap:

- **Time.** Ten minutes per quiz, across thousands of people, adds up. For teachers and clinicians, that time comes from somewhere that matters.
- **Trust.** A test that fakes a pay raise, a vacation policy or a health alert makes staff feel tricked by their own employer. Trust is what you need when you ask people to report a real mistake quickly.
- **Noise.** People start to treat every odd email as "probably one of IT's", and they may report real phishing less urgently, or ignore a real message from IT.
- **False comfort.** A dashboard with a falling click rate looks like progress, but the rate depends heavily on how hard the lure was. In the UC San Diego study, one lure drew 1.8% of clicks and another drew 30.8%.

## Why does deleting still count as a fail?

That complaint from the teacher points at a real design flaw. Most simulation tools can record opens, clicks, submitted credentials and reports. A fair program only penalizes what caused harm, which is entering details or running something. Deleting a suspicious email is a safe outcome. If your program assigns training for it, the tool's settings are likely wrong rather than the policy being deliberately silly, and it's worth asking. You may also find that a preview pane or mail scanner triggered a false "open" or "click".

## If you're on the receiving end

- **Use the report button** on anything suspicious, test or not. It's usually the quickest way to clear the message and it counts as a pass.
- **Don't try to work out whether it's a test.** Treat them all as real, and you'll be right when one is.
- **If you clicked a real one, tell IT immediately.** They can do far more in the first few minutes. A good team will thank you.
- **Send IT this research.** Politely. Many admins are running these programs because an insurer, auditor or manager requires it, and they may welcome the ammunition.

## If you run the program

You don't have to scrap everything overnight. A saner version looks like this:

1. **Cut the frequency** to what your insurer or auditor actually requires.
2. **Drop the punishing follow-up.** Don't assign quizzes for opens or deletes, and don't publish names.
3. **Don't use cruel lures.** Fake bonuses and fake health scares cost you goodwill and prove little.
4. **Make reporting one click**, and answer every report. ETH found this keeps employees engaged and detects campaigns quickly.
5. **Spend the savings on controls that work when people fail:** [phishing-resistant MFA](https://www.phishclean.com/blog/what-is-phishing-resistant-mfa), password managers and [browser-level protections](https://www.phishclean.com/blog/stop-employees-entering-passwords-on-phishing-sites). The UC San Diego researchers recommend the same direction.

We have a more detailed plan for [people who keep failing](https://www.phishclean.com/blog/users-keep-failing-phishing-tests).

A disclosure: we make a product that warns people on the page, so we benefit from this argument. That's why every number here links back to the original research.

## Frequently asked questions

### Do phishing simulations actually work?

Large studies suggest the effect is small. A UC San Diego Health trial with about 19,500 employees found roughly a 2% reduction in clicking from embedded training, and an ETH Zurich study found embedded training didn't make employees more resilient. Results can vary by program design.

### Why do I have to take a quiz if I deleted the phishing test?

It depends on how your organization set up its tool. Deleting a suspicious email is a safe outcome, so a quiz for that is worth questioning with IT. A preview pane or mail scanner can also record a false open or click.

### Should I report a phishing test or just delete it?

Report it. It usually counts as a pass, it removes the message and it's the habit that helps most when a real phish arrives.

### Are phishing simulations required for compliance?

Some insurers, auditors and contracts ask for phishing awareness activity. Check what yours requires, since it may be less frequent than what you currently do.

[Users keep failing phishing testsA practical plan for repeat clickers.](https://www.phishclean.com/blog/users-keep-failing-phishing-tests) [Spot a phishing email that looks legitStart with the request, not the branding.](https://www.phishclean.com/blog/how-to-spot-phishing-email-that-looks-legit) [How to protect yourself from phishingThe habits that work when you're fooled.](https://www.phishclean.com/blog/how-to-protect-yourself-from-phishing) [Why browser warnings come too lateWhere the real gap is.](https://www.phishclean.com/blog/why-browser-warnings-often-come-too-late)

## Sources

- [UC San Diego: Cybersecurity training programs don't prevent employees from falling for phishing](https://today.ucsd.edu/story/cybersecurity-training-programs-dont-prevent-employees-from-falling-for-phishing-scams)
- [Ho et al.: Understanding the efficacy of phishing training in practice](https://sysnet.ucsd.edu/~voelker/pubs/phishtrain-oakland25.pdf) (paper, IEEE S&P 2025)
- [Lain, Kostiainen and Capkun: Phishing in organizations](https://arxiv.org/abs/2112.07498) (ETH Zurich, IEEE S&P 2022)
- [Lain et al.: Content, nudges and incentives](https://arxiv.org/abs/2409.01378) (follow-up study of embedded phishing training)
- [Malwarebytes: How a few PhD students revealed that phishing trainings might not work](https://www.malwarebytes.com/blog/podcast/2022/01/how-a-few-phd-students-revealed-that-phishing-trainings-might-just-not-work-lock-and-code-s03e03)

## Protection that doesn't need a quiz

PhishClean warns on the fake page itself, at the moment it matters. Your team doesn't have to remember anything.

[See PhishClean for Teams](https://www.phishclean.com/business)

Last updated: 5 November 2026