November 5, 2026 - 5 min read

By PhishClean Research Team

Users keep failing phishing tests: what to do about repeat clickers

More training is the obvious answer, and the evidence for it is weak. Here is what the big studies found, and a practical plan for the people who keep clicking.

A thread on r/cybersecurity about users repeatedly failing phishing campaigns drew over a hundred comments, and one line got to the heart of it: most phishing training, especially blind phishing tests, is actively counterproductive. That's a strong claim. The evidence doesn't go quite that far in every case, but it's closer than most security awareness vendors would like.

What the two biggest studies found

The ETH authors tie the backfire to false reassurance: 43% of surveyed employees said that seeing the training page made them feel safe. They also caution that the result applies to their voluntary delivery method. Results from other programs may differ. Still, neither study supports the usual plan of assigning a longer module to whoever clicked.

The click rate depends on the lure

Before you label anyone, look at this. In the UC San Diego study, 1.8% of employees clicked a link about updating their Outlook password, while 30.8% clicked a fake update to the organization's vacation policy. Same people, same training, 17 times the click rate.

And over eight months, more than half of employees clicked at least one link. Given enough attempts, nearly everyone clicks something. So a "repeat clicker" may be someone who has a bad week, or who received harder emails. Some of the differences are real, since ETH found a small group fell repeatedly, but a raw failure count is a poor way to find them. It also makes your quarter-over-quarter trend meaningless if the lures change.

A plan for repeat clickers

1. Look at the job before the person

Accounts payable opens invoices from strangers. HR opens CVs. Reception clicks links from the public. Teachers, as one r/Teachers thread reminded us, get mail from parents all day. If someone's job is to open unexpected messages, clicking is a design problem. Pull your failures by role before you pull them by name.

2. Make the click cheap

This is where the effort pays off. The UC San Diego researchers recommend the same direction: technical countermeasures, particularly two-factor authentication and password managers that only work on the correct domain. For anyone who has failed more than once, in this order:

• Phishing-resistant MFA. A passkey or security key can't be typed into a fake page, so a click doesn't become a stolen login. Treat your repeat clickers as a priority group for rollout, right after admins.
• A managed password manager. No autofill means wrong site. Our guide to stopping employees from entering passwords on phishing sites covers the free browser policies too.
• Least privilege. Does this mailbox need to approve payments alone? Does this laptop need admin rights? A second approver for bank detail changes stops a lot of fraud.
• A warning at the moment of the mistake. Training happens weeks before the click. A warning on the page appears at the click. That's the gap PhishClean for Teams is built for, though any page-level control is better than none.

3. Have a short, private conversation

Ask what the person saw and why it looked real. You'll learn which lures work in your organization and what people's inboxes look like. Do this once, without a form, without a manager in the room, and without naming anyone in a report. If someone has also clicked real phish, that's a security conversation and it's worth having. If it's only simulations, keep it light.

4. Stop punishing, start measuring reports

If people fear getting caught, they hide their real mistakes, and the first hour after a real click is when your team could still stop it. Reward reports instead. Track:

• Report rate: how many people flag a phish, not how many miss it.
• Time to first report: how quickly the first person speaks up. ETH found reporting detects new campaigns quickly.
• Time to contain: how fast your team can pull the message from every inbox.
• Accounts actually compromised: the number the program exists to lower.

5. Run fewer simulations, and only for a reason

You might still want some tests: to practice the report button, to check that your response works, or to satisfy an auditor who asks for them. A few per year does that. If a client or insurer requires a metric, offer reporting rate alongside the click rate. For the case for and against, see do phishing simulations work?

What about someone who clicks everything?

They exist. If a person keeps entering credentials on real phishing pages after you've made these changes, treat it as an access decision rather than a training one. Give them a phishing-resistant sign-in with no fallback, tighter mail filtering, a Strict policy tier if you're on Defender for Office 365, and less access to sensitive systems. A person with no ability to approve payments and a key that can't be phished is a much smaller risk, whatever they click.

How to pitch this to leadership

"We're spending less time testing people and more time making sure one click can't become a breach." Back it up with the two studies above, and show the lure spread from your own campaigns. Most executives would rather fund a security key than another quiz.

Frequently asked questions

What should you do with employees who repeatedly fail phishing tests?

Look at their role and at the lures first, have a short private conversation, then reduce what a click can do: phishing-resistant MFA, a managed password manager, least privilege and on-page warnings. Avoid punishment, which discourages reporting.

Does more phishing training help repeat clickers?

The evidence is weak. A UC San Diego Health study of about 19,500 employees found a roughly 2% reduction from training after a failed test, and an ETH Zurich study of over 14,000 found embedded training did not make employees more resilient.

Should employees be punished for failing phishing simulations?

We don't recommend it. Fear makes people hide real mistakes, and the first hour after a real click is when your team could still limit the damage. Reward fast reporting instead.

What should we measure instead of click rate?

Report rate, time to first report, time to contain and accounts actually compromised. Click rate depends heavily on how hard the lure was, so it makes a poor trend line.

Sources

• UC San Diego: Cybersecurity training programs don't prevent employees from falling for phishing
• Ho et al.: Understanding the efficacy of phishing training in practice (paper, IEEE S&P 2025)
• Lain, Kostiainen and Capkun: Phishing in organizations (ETH Zurich, IEEE S&P 2022)
• SecurityWeek: Simulated phishing tests make organizations less secure (summary of the ETH study)

Last updated: 5 November 2026