Phishing Simulation Tracking Worksheet
Phishing simulations only help if you track what changed. This worksheet records each campaign by audience and lure, calculates click, credential and report rates, and gives you an overall trend you can show management.
| Campaign | Launch date | Audience | Lure type | Sent | Clicked | Entered credentials | Reported | Click rate | Credential rate | Report rate | |
|---|---|---|---|---|---|---|---|---|---|---|---|
22.5% | 7.5% | 20% | |||||||||
18.3% | 5.8% | 25.8% | |||||||||
13.7% | 5% | 25.3% | |||||||||
20.7% | 4% | 16% | |||||||||
10.8% | 3.2% | 31.1% |
Replace the sample rows with your own campaigns. Report rate is the number of people who reported divided by messages sent. Count each person once per campaign. Use simulations for learning, not punishment, and avoid naming individuals in the shared version.
Optional awareness targeting review
Ask how to focus training on people with purchasing, payment or admin rights in your ERP.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
Add one row per campaign and audience. Enter how many messages were sent, how many people clicked, how many entered credentials on the landing page and how many reported the message through the report button or to the security mailbox. The rate columns calculate themselves. Export to Excel to chart the trend. Compare like with like: the same audience and a similar lure difficulty, otherwise a lower click rate may only mean an easier test.
- One row per campaign and audience
- Count unique people, not repeat clicks
- Keep lure types consistent for comparisons
Which rate matters most
Click rate is the number everyone quotes, but report rate is the better sign of a healthy culture, because reported messages give your team an early warning in a real attack. Credential rate shows who went all the way. A falling click rate with a rising report rate is the pattern to aim for. Plant floor staff often have no daily email use, so compare them against themselves, not against the office, and consider SMS, QR code and USB lures that match how they are really targeted.
Common mistakes
Do not turn simulations into a punishment scheme, because staff then stop reporting. Do not run the same easy lure repeatedly and call the result progress. Make sure your mail filter allow-lists the simulation domains, or the data will be wrong. And remember that the real aim is behaviour change: pair each campaign with short training and a visible way to report.
- Check allow-listing before launch
- Vary lure difficulty and channel
- Reward reporting
- Track results by group but protect individual privacy
Frequently Asked Questions
What is a good phishing click rate?
It depends on lure difficulty and audience. Many programs start in the double digits and aim for single digits over time. Focus on the trend, and on rising report rates, rather than comparing to another company's number.
How often should we run simulations?
Monthly or quarterly is common, with short training right after. More frequent sends to the same people tends to cause fatigue. Rotate lure types and audiences, including finance and executives.
How do I treat people who entered credentials?
Give immediate, private micro-training and reset guidance in a learning tone. Escalate repeated high-risk behaviour through coaching, not public shaming, so reporting stays safe.
Can I include plant floor employees without company email?
Yes. Use other channels they actually use, such as SMS or QR codes on notice boards, and compare them with their own past results. Log those campaigns here with a matching lure type.
If you want phishing and awareness data combined with ERP user roles to focus training on people with payment or purchasing rights, Netray can talk through a private approach. The worksheet needs no sign-up.
Related Tools
Manufacturer Ransomware Readiness Assessment
A 10-question self-assessment that scores how ready a manufacturing site is to prevent, survive and recover from ransomware, including OT and ERP recovery.
Compliance & ContractsEnterprise Password and Passphrase Policy Template
A fill-in password policy that covers length, MFA, lockout, service accounts and shop floor shared logins, aligned with current NIST thinking.
Industry TemplatesManufacturing Cyber Incident Response Plan Template
A fill-in incident response plan covering roles, severity levels, containment of IT and plant floor systems, communications and recovery, exportable as a document.
Industry TemplatesOT Asset Inventory Worksheet
An editable inventory of operational technology assets with Purdue level, firmware, support status and a criticality times exposure risk score.
More Safety & Workforce tools
See all- Shift Schedule Template (2-2-3 and 4 On 4 Off)
- Absenteeism Cost Calculator for Manufacturing
- Production Operator Certification Checklist
- Production Line Staffing Calculator (Direct Labor)
- Production Operator Skills Matrix Template
- OJT Training Sign-Off Record Template
- Cross-Training Coverage Matrix Worksheet
- Operator Learning Curve Ramp-Up Cost Calculator
- Cross-Training Payback Calculator