When we ship TrendTech's executive-reporting layer, the headline metric on the one-page board summary is reporting-rate, not click-rate. This is a deliberate choice that runs against the category norm.
Click-rate is the metric most security-awareness platforms report as their headline. There are reasons for this — it is simple, it is intuitive, it has been the category convention since the category emerged a decade ago. But click-rate is increasingly a vanity metric. It is downward pressure on a narrow behaviour, gameable through narrow simulation libraries, and weakly correlated with overall organisational resilience.
Reporting-rate — the proportion of recipients who flagged the simulation through the official reporting channel — is structurally different. It is harder to game, because reporting is an active behaviour requiring confidence and habit rather than the avoidance of an active behaviour. It generalises across lure families, because the underlying capability is recognising-the-pattern-is-unusual rather than recognising-this-specific-pattern.
And it is more predictive of how an organisation handles a real incident. A workforce with a 40% reporting-rate is materially more likely to detect a real campaign within the SOC-actionable window than a workforce with a 5% reporting-rate, regardless of the click-rate either workforce achieves.
We ship both metrics. Operational dashboards expose click-rate, repeat-clicker tracking, and the underlying cohort drill-downs. Executive reporting leads with reporting-rate, with click-rate as a secondary diagnostic.
Customers tell us the executive reporting framing changes the conversation at board level. The shift from "how many people clicked" to "how quickly are we detecting" is a shift from compliance evidence to actual risk management — and boards respond differently to the two framings.