The Starting Point
When our customer success team started with a mid-market financial services firm in the Midwest, the phishing setup was the usual one. Roughly 1,100 employees, a SOC of four analysts, a legacy secure email gateway, and quarterly security awareness training delivered through a learning management system that nobody opened voluntarily. The baseline phishing simulation we ran in month one produced a click-through rate of 18.3 percent and a credential submission rate of 6.1 percent. For a firm that moves client funds and processes wire instructions daily, those numbers were not acceptable.
Nine months later, the same firm reported a click-through rate of 1.5 percent on simulated phishing and zero confirmed credential submissions during the final measurement window. This write-up is the nine-month path: what moved the numbers, what we dropped, and why continuous exposure monitoring ended up doing more work than the training platform.
Why Traditional Security Awareness Training Fails
Before the program launched, the firm had been running annual security awareness training for six years. Completion rates were strong on paper. Real-world click-through rates never moved. The root causes were the usual ones.
The Annual Training Trap
- Content was generic and aged poorly against modern lures
- Employees treated it as a compliance checkbox, not a skill
- There was no feedback loop between real incidents and training content
- Finance, operations, and executive assistants received the same material despite facing very different threats
The Measurement Gap
The firm tracked completion, not behavior change. Nobody knew which employees were repeatedly clicking, which departments were being targeted, or how employee behavior correlated with actual exposed credentials surfacing in stealer logs. Without that visibility, every dollar spent on training was a guess.
Building the Four-Pillar Program
We built the program on four pillars that fed each other. One pillar alone would have moved the needle a little. Four of them stacked.
Pillar 1: Realistic Simulated Phishing
Monthly simulated phishing campaigns replaced the old quarterly model, with lures rotated across the techniques employees were actually seeing in production.
- Credential harvesting pages mimicking Microsoft 365 and the firm's VPN portal
- QR code phishing embedded in PDF attachments, targeting mobile-device scanning behavior
- MFA fatigue scenarios simulating push-bombing after a hypothetical credential leak
- Vendor impersonation lures referencing real suppliers the finance team worked with
- Voicemail and Teams-message callback lures targeting the executive assistant pool
Difficulty escalated over time. In month one the lures had obvious red flags. By month six they included cloned branding, valid-looking sender domains registered days earlier, and contextual hooks pulled from publicly available firm news.
Pillar 2: Just-in-Time Training
The biggest behavioral shift came from killing scheduled training entirely for most of the workforce and replacing it with just-in-time training triggered by actual clicks. When an employee clicked a simulated lure, they landed on a 90-second micro-lesson tied to the specific technique that had fooled them. No slide decks, no certificates, no quizzes longer than three questions.
Employees who never clicked received quarterly five-minute refreshers. Repeat clickers were enrolled in a coached track with their manager notified. This turned training from a calendar event into a consequence.
Pillar 3: Exposure Monitoring via Revealer.US
This was the pillar the firm had never considered. We onboarded their domains into Revealer.US and began continuously monitoring for employee credentials appearing in stealer logs, combolists, and breach datasets. Within the first 30 days we surfaced 47 exposed employee credentials, including 12 that still worked against the firm's VPN and 3 that belonged to users with privileged access.
It paid off in two ways.
- Immediate containment: Compromised accounts were reset and investigated before attackers could exploit them
- Employee risk scoring: Users whose credentials appeared in external exposures were flagged as higher-risk and routed into the coached training track, regardless of whether they had clicked a simulation
Employee risk scoring is what tied the program together. Instead of treating all 1,100 employees identically, the SOC focused its limited attention on the roughly 80 users whose combined signals (clicks, exposures, department, and access level) placed them in the top risk quintile.
Pillar 4: Hardened Email Security
The firm replaced its legacy secure email gateway with a modern API-based email security layer that could inspect post-delivery messages, rewrite URLs, and detonate attachments in a sandbox. We layered DMARC enforcement at p=reject, enabled strict SPF alignment, and implemented banner warnings on any external email containing financial keywords. None of this was novel. It simply had not been done.
Measurement Methodology
Without a measurement methodology you have a story. We tracked four metrics across the nine-month window.
- Click-through rate (CTR): Percentage of recipients who clicked a simulated lure
- Credential submission rate (CSR): Percentage who then entered credentials on the landing page
- Report rate (RR): Percentage who reported the message via the report-phish button
- Mean time to report (MTTR): Minutes between delivery and first report
Simulations were sent in waves of roughly 250 recipients, rotated so no single employee received more than one campaign per month. We controlled for lure difficulty by scoring each campaign against a standardized rubric, and compared month-over-month trends only across lures of similar difficulty.
Results
The numbers moved in the direction we wanted, but not in a straight line.
Month-by-Month Trajectory
- Month 1 baseline: 18.3% CTR, 6.1% CSR, 9% RR, 42 minute MTTR
- Month 3: 11.7% CTR, 3.4% CSR, 24% RR, 18 minute MTTR
- Month 5: 6.2% CTR, 1.2% CSR, 41% RR, 11 minute MTTR
- Month 7: 3.8% CTR, 0.4% CSR, 58% RR, 7 minute MTTR
- Month 9: 1.5% CTR, 0.0% CSR, 67% RR, 4 minute MTTR
The report rate mattered as much as the click-through rate. By month nine, employees were reporting suspicious messages within minutes, giving the SOC actionable signal on real-world campaigns before they spread.
What Did Not Work
Two interventions we tried early produced no measurable benefit and were dropped.
- Gamified leaderboards ranking departments by click rate. Finance hated being publicly shamed, and the leaderboard created incentives to hide clicks rather than learn from them.
- Long-form monthly newsletters summarizing recent threats. Open rates hovered near 8 percent. The content was good. Nobody read it.
Lessons for Security Leaders
No single vendor, tool, or LMS produced this. Four feedback loops did: exposure data shaped training, training shaped simulations, simulations shaped risk scores, and the scores told the SOC where to spend time.
Three takeaways travel to any org trying the same thing.
- Measure behavior, not completion. Training hours are vanity metrics. CTR, CSR, and report rate are what actually move.
- Personalize by risk, not by role. A junior analyst with exposed credentials in a stealer log is a higher-priority training target than a senior executive with a clean record.
- Integrate exposure monitoring early. Phishing prevention without visibility into what has already leaked is half a program. Real-time stealer log monitoring closed the loop the firm did not know was open. You can see how we approach this on our pricing page.
Conclusion
A 92 percent drop in phishing click-through is doable. Annual awareness training is not the path; that is a ritual with a completion certificate. This firm got there by treating phishing as an operations problem with numbers, and by putting exposure monitoring in front as the warning system the rest of the program needed.
Nine months in, the number I cared about was not the click-through rate. The SOC spent 40 percent less time chasing false positives, because the same risk scores that ranked training also ranked alerts. That is how the program paid for itself twice.
Want to build a phishing prevention program that actually moves the numbers? Start a free trial of Revealer.US and give your security awareness training the exposure data it has been missing.