The Fix Most Phishing Programs Are Missing: What Happens After the Click
Someone in accounts payable clicks a link in a simulated invoice email. The platform records the click; the quarter’s failure rate moves a fraction of a point, and the event lands in next month’s report. Follow-up training, if it happens at all, waits until someone on the security team has time to assign it by hand. On a lean team, that can take weeks.
By then, the person who clicked has moved on and eventually, what shows up in their queue is the same generic remedial training everyone else gets.
Most phishing programs put their energy into designing the simulation and reporting on it. Far less thought goes into what happens after someone clicks. That stretch is the most overlooked lever in a phishing program and, for a lot of teams, it’s where the program quietly stops.
What happens after the click matters
Most phishing programs treat a failed simulation as a data point. That data point feeds a click rate, and the click rate feeds a dashboard. That’s useful for spotting trends, but it treats the click as the end of the story. (Click rates leave out a lot, which we dig into in Beyond Click Rates: A Smarter Approach to Cybersecurity Awareness Training.)
The moment after a click can also be one of curiosity. Many people who land on a “this was a test” page want to know what they missed. The research below shows that they also leave quickly, and a lesson that feels like a reprimand loses them faster. What happens next can shape whether the next suspicious email gets reported or quietly ignored.
Does just-in-time phishing training work? What the research says
It’s worth being clear that just-in-time and remedial phishing training have a mixed research record. Two large field studies tested the common version of post-click training: A page employees could skip.
In a 2025 randomized study of more than 19,500 UC San Diego Health employees, that training reduced later failures only slightly, and about 75% of people spent a minute or less on it.
A 15-month study of more than 14,000 employees led by researchers at ETH Zurich found that voluntary embedded training didn’t improve resilience and, in some cases, left employees more susceptible. Its authors noted they hadn’t tested mandatory training.
Neither study found that timing or lure-specific content alone changed outcomes. The UCSD study did conclude that employees who completed interactive training were less likely to fail later simulations, while those who completed multiple static sessions were more likely to fail.
Because only some people finished the interactive sessions, the authors caution this may partly reflect who completes training. The research supports a narrower claim than “follow-up works.” Follow-up that people actually engage with may help, and follow-up they skip doesn’t.
What the research does support: Easy reporting
The ETH Zurich study found three things that held up:
- Warnings on suspicious emails sharply cut clicks.
- Employees kept reporting for the full 15 months with no sign of reporting fatigue.
- Employees who received positive feedback after reporting reported even more frequently.
That’s the “after the click” worth building around: Make the next report easy, and make it feel safe to send one.
NINJIO ALERT puts a one-click report button inside the email interface, flags reported emails in the platform, and, depending on the email client, can send a confirmation notification. A suspicious message reaches your security team without anyone writing an email.
That leaves three things the follow-up training has to get right: A steady rhythm, relevance, and automation. When one is missing, the other two usually don’t get a chance to matter.
Timing: A steady rhythm, not a reprimand
Remedial phishing training shouldn’t wait on an admin’s spare hour, which is how it slips from days to weeks. It also shouldn’t land like a reprimand. The research above found that the common approach, a page shown right after the click, did little: Many people skipped it, and, in one study, it left some employees more susceptible.
Relevance: Teach to the person’s patterns
The default follow-up in many programs is some version of “don’t click suspicious links.” Everyone who clicked already knows that, so it says nothing about why this kind of email gets past them.
Phishing works by putting pressure on a specific emotion. A fake overdue invoice leans on urgency, while a message that appears to come from the CEO leans on obedience to authority.
NINJIO’s approach starts from the premise that people differ in which pressure moves them most, and that a person’s susceptibility pattern emerges over several phishing simulations. We build coaching around that overall pattern, not around the single email someone clicked.
The research above doesn’t show that lure-specific content alone changes outcomes, so we treat relevance as a way to make coaching worth finishing, not as a guarantee. Coaching that names the pressure (“deadlines like this are built to rush you”) can help people recognize the same move in a real message, whatever the subject line says.
Automation: Make follow-up happen without a to-do list
Most security leaders already agree with everything above. The obstacle is operational. When the person who owns the phishing program also owns endpoint management and the next audit, hand-assigning phishing simulation follow-up is the first task to slip.
A Security Analyst running day-to-day simulations can keep up for a while, though rarely across every campaign and every department.
Automation is what makes a steady rhythm and relevance realistic for a lean team. When you set up automated phishing remediation alongside the simulation, it goes out on its own with the right lesson, whether or not anyone on the team is watching the dashboard that day.
How NINJIO SENSE handles the follow-up
PHISH3D simulations build an Emotional Susceptibility Profile for each person, tracking how they respond to seven emotional triggers: Fear, urgency, greed, curiosity, social, opportunity, and obedience. NINJIO SENSE uses that profile to send 60-second coaching episodes built around the pressures each person is most susceptible to, and the coaching adapts as the profile changes. Nobody assigns it by hand.
SENSE coaches to a person’s overall profile, not to the specific email they clicked, and admins set the cadence. Our methodology is a regular rhythm rather than training at the moment of failure. We built NINJIO to fit how your team works, so admins can adjust audiences and cadence as they see fit.
Frequently Asked Questions
Treat it as information, not a verdict. Keep it private and neutral, and don’t single the person out. Make sure follow-up happens on a predictable schedule instead of waiting for an admin to assign it. The follow-up should explain the pressure behind this kind of email, such as a fake deadline or a message posing as a senior leader. Thank people when they report suspicious emails, so reporting feels safe.
There’s no firm evidence that immediate training beats a regular schedule. In two large studies, training shown right after a click did little, and many people skipped it. NINJIO doesn’t typically recommend remedial training at the moment of failure, because it can feel punitive and disruptive. What matters more is that follow-up arrives predictably, without waiting for someone to assign it, and that it’s short enough to finish.
The evidence is mixed. Large studies at UC San Diego Health and at a company studied by ETH Zurich found that training shown right after a click had small or no measurable effect, largely because many people skipped it or never finished.
The research did find that employees who completed interactive training were less likely to fail later simulations, though the authors caution this may reflect who chose to finish. Timing and relevance alone don’t appear to be enough. Follow-up looks most promising when it’s short, interactive, and engaging enough that people complete it. NINJIO’s approach is a regular coaching rhythm rather than training at the point of failure.
Tie follow-up to your simulation program, so the platform delivers it without manual assignment. In NINJIO, PHISH3D results build each person’s Emotional Susceptibility Profile, and SENSE sends personalized 60-second coaching on a cadence the admin sets. That removes the manual step, and the coaching reflects each person’s overall pattern rather than a single click.
Keep follow-up short, private, and predictable. Make it specific to the pressures that work on each person over time, not just the last email they clicked. Automate delivery, so it doesn’t depend on someone assigning it by hand, and make reporting easy and rewarded. Then, track more than click rates, such as report rates and whether people finish the coaching.
