If you’ve never run a phishing simulation against your own team, you don’t actually know your security posture. You know what your tools block. You don’t know what your people would click.
Here’s what Houston-area small businesses tend to find when they run serious simulation programs, what surprises them, and what they do differently as a result.
The starting numbers
First-run results are almost always sobering. When a small business runs its first baseline simulation, a meaningful share of employees — usually more than the owner expected — click the simulated phishing link.
That’s normal; it’s exactly why you test. But seeing your own team’s number is what makes it real.
Click-through by department
Patterns that come up repeatedly:
- Sales consistently had the highest click-through rates. Sales people are trained to respond to prospects quickly; that exact reflex gets exploited.
- Accounting / accounts payable was the second-highest, often via invoice and vendor-payment pretexts.
- Executives were a notable third — partly because they often have admin assistants who screen email for them and miss the targeted ones, partly because they’re frequently the target of CEO-impersonation simulations from below.
- Engineering / technical staff often performed best on technical-themed lures and worst on emotional / urgency-based ones.
- Customer service was middle of the pack but very fast to improve with training.
What worked in 2026
The change that tends to move the numbers the most: making the post-click experience educational, not punitive. When an employee clicked, they got a friendly page that said "this was a simulation — here’s what to look for next time," not a public name-and-shame.
The training format that tends to work best: short (roughly 90-second) videos delivered immediately after a click. In our experience, long quarterly modules land worse than short, in-context micro-training.
What also worked:
- Quarterly simulations, not annual. The skill atrophies fast.
- Realistic lures based on current attacker tactics, not generic "you have won a prize" emails.
- Including the owner / executives in the simulations from day one. If leadership opts out, the program loses credibility.
- Celebrating reporters (people who report a phish without clicking) as much as fixing clickers.
What didn’t work
- Annual or one-off campaigns. Skills decay fast.
- Pretending the program is purely IT’s responsibility. The CEO has to visibly engage.
- Punishing clickers. People hide future clicks. Worse outcomes overall.
- Generic, obviously-fake lures. People learn to spot the simulator, not actual attackers.
The 12-month trajectory
Businesses that stick with a quarterly program typically see click-through rates trend like this:
- Quarter 1: the baseline — often uncomfortably high
- Quarter 2: a noticeable drop as the first round of micro-training lands
- Quarter 3: continued improvement, and more people reporting instead of clicking
- Quarter 4: a much lower, steadier rate
Zero is not a realistic target. The goal is a low, stable click rate and a high report rate.
What to do this month
If you’ve never run a phishing simulation:
- Pick a platform. Microsoft’s Attack Simulation Training is included with Defender for Office 365 Plan 2; dedicated phishing-simulation platforms are the other option, and many offer free trials.
- Run a baseline simulation against everyone, including ownership.
- Don’t share individual results publicly. Share department averages.
- Schedule the next one for January, then quarterly.
- Make sure every clicker gets short, immediate training, then move on.
If you’d rather have someone else run the program, this is one of the things we do as part of managed services. Book a free discovery call to talk through it.
Aspendora Technologies provides cybersecurity, security awareness training, and managed IT for Houston-area small businesses since 2010.