A Nairobi insurance firm runs its first phishing simulation. 32% of staff click. The CEO panics. Six months and three training cycles later, the rate drops to 8%. Everyone celebrates. But here is the uncomfortable question nobody asks: was the second test as hard as the first one?
The phishing click rate is the most quoted metric in security awareness training, and also the most misunderstood. A low number can hide a weak test. A high number can reflect an unusually tough lure. Before you report either to your board, you need to know what the figure actually measures, and what a healthy post-training benchmark looks like for a Kenyan or East African business.
What the Click Rate Really Measures
The click rate is the percentage of staff who clicked a link, opened an attachment, or entered credentials into a simulated phishing page. On its own, it tells you almost nothing. Three variables decide whether the number is meaningful:
- Lure difficulty: A generic "You have won a prize" email will produce a very different result from a spoofed email appearing to come from your Head of Finance about an urgent KRA filing.
- Pretext relevance: A simulation referencing M-Pesa, NHIF, SHA, a known supplier, or a recent internal event will always perform differently from a generic template.
- Timing: Phishing sent at 4:45pm on a Friday during month-end payroll will convert at a far higher rate than the same email on a quiet Tuesday morning.
If your vendor cannot tell you the difficulty rating, the pretext, and the send-time of each simulation, your click rate is a vanity metric. Push back and demand that context.
Two other figures matter as much as the click rate itself:
- Report rate: the percentage of staff who flagged the email through a reporting button or to IT. This is the number that actually tells you whether your culture is improving.
- Credential submission rate: of those who clicked, how many went on to type a password. This is your real exposure number.
Benchmarks: What Good Looks Like
Industry reports from vendors like Proofpoint, KnowBe4 and Verizon's DBIR suggest that untrained workforces typically click on phishing simulations at rates between 25% and 35%. These figures come from global datasets, so treat them as directional rather than definitive for the East African market.
Realistic targets after a structured programme:
- Baseline (no prior training): expect 20–35% click rate on a moderately difficult lure.
- After 6 months of monthly simulations and short training: 10–15% is a reasonable target.
- After 12+ months of continuous training: 5–8% click rate, with a report rate above 20%, is a mature programme.
- A click rate below 2%: be suspicious. Either the simulations are too easy, or staff have memorised the sender address.
Segment the data. A finance team clicking at 4% while customer-facing staff click at 18% is a very different problem from a flat 10% across the business. Role-based risk should drive training frequency.
Why the Click Rate Alone Will Mislead Your Board
Reporting a single falling number to your board feels like progress, but it buries three realities:
1. Attackers escalate difficulty, your simulations should too. If your click rate drops while the lures stay easy, you are measuring familiarity with your vendor, not resilience against real threat actors targeting Kenyan businesses.
2. One trained click is still a breach. Under the Kenya Data Protection Act, a single successful credential theft that exposes personal data can trigger a notifiable incident to the Office of the Data Protection Commissioner. A 5% click rate across 200 staff is still 10 potential incidents per campaign. Kenya Data Protection Act Incident Response Guide
3. Behaviour change is not linear. Click rates plateau. The next gain comes from improving the report rate, shortening report time, and reducing credential submission, not from squeezing the click number further.
What to Measure Instead
Build a scorecard with four numbers, not one:
- Click rate, with lure difficulty tagged
- Report rate, with median time-to-report
- Credential submission rate
- Repeat-clicker percentage (staff who clicked on two or more consecutive simulations)
Repeat clickers are your real risk concentration. A programme that reduces this group from 8% to 1% has done more for your security posture than one that moves the average click rate by five points. Security Awareness Training Services
A good phishing programme makes attacks visible. A great one makes staff the sensor network that detects them before IT does.
The Bottom Line
If your current provider reports only a click rate, you are not getting a programme. You are getting a monthly email and a graph. Measure difficulty, report rate, credential submission and repeat clickers, and the picture changes entirely.
Find out how many of your staff would click. SecureZaidi runs a free, safe phishing baseline for up to 10 employees, with your written sign-off. Get in touch.