Every year the reminder goes out, staff work through the modules, and the completion report comes back at or near 100%. There is a record to show an auditor or an insurer if either of them asks, and on paper the box is ticked.
Completion tells you people attended. It doesn't tell you whether anyone would slow down the next time a convincing email asks them to change a supplier's bank details late on a Friday afternoon, and that is much harder to measure.
People remain part of most breaches. The human element was involved in 62% of the breaches analysed in the latest Verizon Data Breach Investigations Report (Verizon 2026 DBIR).
Compliance first, risk second
Most programs I come across were set up compliance first and risk reduction second. Ideally that order is reversed. If the aim is to tick a compliance box and the outcome does not matter much, almost any platform will do the job. If the aim is fewer people falling for the email that matters, the questions change: how often people practise, how relevant the practice is to them, and how quickly they report something suspicious.
And if you stop and think, the delivery of this training is time sensitive. Run it monthly and you have 12 moments a year with each person, and you will usually hold their attention for five or six minutes at a time. That is a small window to change a habit, so what happens inside it matters a great deal.
One test for everyone gives you bad data
The way simulations are run often undermines what they are meant to measure. Many programs send the same simulated phishing email to everyone at the same time. Within minutes someone posts in the team chat, check out this fake email, don't click it, and the test is over for most of the audience. You get bad data back.
Simulations that adapt to each person's skill level and the kinds of lures they tend to fall for give a far more accurate picture. Choosing a different simulation for each person across a few hundred staff is not possible for a human team to do by hand, and this is one place where AI in the platform earns its keep.
How the program is introduced
The way leadership positions the program shapes the result more than most platform decisions. If it arrives as a mandatory tool, run in a very regimented, police-like way, you should expect low participation, and a quiet frustration with whoever brought it in.
Where the executive team backs it, line managers are brought in early, and staff are told plainly that this is a learning journey and it is okay to get things wrong, engagement tends to rise whichever platform sits underneath. The people choosing these platforms are usually IT and security leaders with a great deal of technical depth, and the change work is a different skill. The first months are organisational change as much as a technology rollout.
Reporting matters here too. When someone reports a simulation correctly and is thanked for it on the spot, reporting becomes the easy, rewarded thing to do, and you tend to hear about the real attacks sooner.
See it in your own environment
A baseline is the sensible place to start, ideally before any platform decision. A short simulation across a small group, tailored to the people receiving it, together with a look at how often staff report what lands in their inbox, will tell you more about your current program than its completion rate.
Ideally the result comes back as a single number you can track through the year and take to the board. No program takes that risk to zero, but the number shows whether it is moving in the right direction, and what to change next can come from your own evidence.