When a board, an auditor or a cyber insurer asks how exposed your organisation is to phishing, they are really asking one thing: if a convincing scam reached our people tomorrow, how many of them would fall for it? A good phishing test for employees answers that question with a number you can defend.
It matters because people are still where most attacks land. Verizon’s 2026 Data Breach Investigations Report found that the human element was involved in 62% of breaches. [1] The question is not whether to test, but what kind of test gives you an answer you can trust.
What a phishing test for employees should measure
A useful test measures four things, not one:
- Judgment. Can each person tell a real message, page or call from a fake one when they see it?
- Coverage. Did everyone actually take part? Someone who never saw the test tells you nothing, and should not quietly count as a pass.
- Speed. Scams work under pressure. A test with a time budget shows who reads carefully and who guesses.
- Channel. Where are your people weakest: email, text messages, phone calls, QR codes, fake sign-in pages?
Most traditional phishing tests measure only one thing: who clicked a single fake email. That is a much narrower question than the one you are being asked.
Why one fake email isn’t enough
The classic approach sends staff a simulated phishing email and counts the clicks. The trouble is what that number really reflects. A large study at UC San Diego Health followed more than 19,500 employees for eight months. In the first month about 10% clicked a phishing link; by the eighth month, more than half had clicked at least one. Annual training made no significant difference, and training shown after a click reduced the chance of clicking by only 2%. [2]
In other words, click rates rise and fall with the template, the timing and how busy people are. They say little about who can actually spot a scam. And because people who never opened the email are scored as if they resisted it, the headline figure can look better precisely because fewer people engaged.
Test the channels scams use now
Email is no longer the only way in, and often not the main one. Mandiant’s M-Trends 2026 found voice phishing in 11% of investigations where the initial entry point could be identified, while email phishing has been in sustained decline. [3] Verizon reported that mobile-based phishing simulations drew 40% more engagement than email ones. [1]
A test that only ever knocks on the inbox misses where many attacks now start. A modern phishing test for employees should include text messages, phone and voice scams, QR codes, fake sign-in pages and lookalike domains, fake CAPTCHA pages that trick people into running commands, payment-redirect requests and executive impersonation.
How to run a phishing test for employees
- Decide what you want to know. A baseline for the whole company, a check on one high-risk team, evidence for an insurer, or a before-and-after for a new control.
- Tell people it is a test. An open test measures judgment cleanly and avoids the trust and HR problems that deceptive tests can cause. People still get caught out, because the examples are real.
- Use current, real techniques. Build questions from scams that are live now, across every channel your people use, and give each person a different mix so answers can’t be shared.
- Add a time budget. Real scams don’t wait. A short limit separates the people reading from the people guessing.
- Choose named or anonymous results. Named results let you follow up person by person; anonymous results show the shape of the risk without storing anyone’s name.
- Score per person, team and channel. And track who has not started, so you know whose risk you can’t see.
- Act on the gaps. Coach the weakest teams on the channels that caught them out, and add technical controls where judgment alone won’t hold.
- Re-test. After a rollout, an incident or a change in threats, and at least once a year, so you can show whether things have actually improved.
Scam Check: a security awareness test for employees
Scam Check is a timed, branded test built from 243 questions on real scam techniques seen between 2024 and 2026, across email, text, phone, QR and more. Every person gets their own link and questions, results are scored per person and per channel, and anonymous mode stores no names at all. Your first campaign is free.
See how Scam Check works →What to do with the results
A scored test gives you something a click rate can’t: a defensible picture of where your human risk really is. Use it to:
- Report one honest number to the board, with a baseline to compare against next time.
- Provide evidence to auditors and insurers who ask what you do about awareness, with per-person or anonymous results you can export.
- Target support at the teams and channels that need it, instead of sending everyone the same annual module.
- Decide where technology has to carry the load. The UC San Diego researchers concluded that organisations should lean on technical countermeasures as well as training. [2] Where people struggle, controls such as real-time browser protection and phishing-resistant sign-in catch what judgment misses.
The goal of a phishing test isn’t to catch people out. It is to find out, before an attacker does, who would be caught out, and to fix that.