Executive Reports: Insights on Repeat Clickers in Phishing Simulations

In 2024, 34.3% of untrained employees failed phishing simulations, underscoring a significant vulnerability in organizational cybersecurity defenses. This trend is particularly concerning in sectors like agriculture and food services, which reported the highest failure rates at 8.2%, followed by banking and financial institutions at 7.8%.

A notable example is the 2017 Equifax data breach, where hackers accessed the personal data of approximately 13.8 million UK consumers. The breach was attributed to Equifax's failure to manage and monitor the security of UK consumer data outsourced to its parent company in the US.

Repeat clickers—employees who consistently fall for phishing attempts—pose a persistent challenge for organizations aiming to strengthen their human firewall. In this blog, we’ll explore the reasons behind repeated failures in phishing simulations, their impact on cybersecurity, and effective strategies for mitigating this risk.

Who Are Repeat Clickers (aka Repeat Offenders)?

Repeat clickers are employees who consistently fall victim to phishing attempts, whether in simulated scenarios or real-world attacks. These individuals represent a small but significant segment of the workforce that struggles to recognize deceptive email tactics, even after participating in security awareness programs.

Key Characteristics of Repeat Clickers

1. Recurrent Behavior: These employees repeatedly fail to identify phishing emails, clicking on malicious links or providing sensitive information.
2. Heightened Vulnerability: They are more susceptible to advanced phishing techniques, including quishing (QR code phishing) and vishing (voice phishing).
3. Disproportionate Impact: Despite their small numbers, repeat offenders significantly increase an organization’s overall risk profile.

Why Do Repeat Clickers Matter in Phishing Simulations?

Repeat clickers or repeat offenders in phishing simulations are a critical concern because they represent a persistent vulnerability in an organization's cybersecurity defenses.

These individuals are more likely to fall for real phishing attacks, increasing the risk of data breaches, financial losses, and reputational damage. Moreover, their behavior often signals gaps in training effectiveness or workplace culture, making them a focal point for strengthening human resilience against cyber threats.

Increased Risk of Breach

Employees who repeatedly fail phishing tests are more likely to fall for real phishing attacks. According to the Verizon Data Breach Investigations Report (DBIR) 2023, phishing accounted for 22% of breaches, with repeat offenders often being the weakest link.

Financial and Reputational Damage

Each phishing incident costs organizations an average of $4.91 million, as per the Ponemon Institute’s 2023 Cost of Phishing Report. Repeat clickers amplify this risk, making it imperative for companies to address this vulnerability.

Compliance and Legal Implications

Regulations like GDPR and HIPAA mandate stringent data protection measures. Failing to manage repeat clickers can result in non-compliance, hefty fines, and legal battles.

Key Causes of Repeat Clicking

Repeat clicking often stems from a combination of factors, including a lack of awareness about phishing threats and cognitive biases that cloud judgment, such as overconfidence or inattentional blindness.

Generic training methods that fail to address individual needs can leave employees ill-equipped to recognize sophisticated scams. Additionally, workplace stress and fatigue exacerbate the issue, making employees more likely to act impulsively when confronted with phishing emails.

Lack of Security Awareness

Despite regular training, some employees fail to grasp the severity of phishing threats. Behavioral patterns often indicate they underestimate the risks associated with their actions.

Cognitive Biases

Psychological factors like overconfidence and inattentional blindness often lead employees to disregard suspicious emails.

Ineffective Training Methods

Generic, one-size-fits-all training fails to resonate with employees, especially those with distinct roles and responsibilities.

Workplace Stress and Fatigue

High workloads and constant distractions make employees more prone to errors. Stressful environments are breeding grounds for repeat clickers.

The Cost of Inaction for Repeat Clickers

Organizations that overlook repeat clickers face cumulative risks. A single employee’s lapse can lead to:

• Prolonged downtime: Recovery from ransomware attacks takes an average of 22 days (Sophos 2023).
• Loss of customer trust: 59% of consumers say they would avoid doing business with a company after a breach.
• Escalating costs: IBM reports that the cost of a breach increases by 10% annually.

Strategies to Address Repeat Clickers

Addressing repeat clickers requires a multifaceted approach to enhance resilience and reduce organizational risk.

Tailored Security Awareness Training

Customizing training modules to address specific vulnerabilities ensures effective learning. Solutions like Security Awareness Training improve employee engagement and retention, helping to mitigate risks associated with repeated failures.

Phishing Simulations with Dynamic Scenarios

Phishing Simulations using tools such as the Phishing Simulator replicate real-world threats like quishing and vishing. Regularly updated scenarios keep employees prepared for evolving cyber risks.

Behavioral Analytics and Monitoring

Platforms like the Keepnet Human Risk Management Platform provide insights into employee behavior. Identifying patterns helps isolate repeat offenders and enables targeted interventions to correct risky habits.

Gamification and Incentivization

Turning learning into an engaging experience through gamification can motivate employees to stay vigilant. Incentivizing phishing resistance, such as through quizzes or rewards, boosts participation and retention.

Executive Leadership and Cultural Change

Executive support is vital in fostering a culture of cybersecurity awareness. Leaders should advocate for continuous improvement and underscore the importance of proactive defense measures.

Looking for more strategies? Check out our in-depth blog on Managing Repeat Clickers in Cybersecurity to learn how to address this persistent challenge effectively.

Segmenting Repeat Offenders to Mitigate Risk

Effective segmentation is significant for addressing risky employee behaviors that may jeopardize an organization's cybersecurity. Keepnet’s platform automatically identifies and categorizes Repeat Offenders—employees who consistently engage in risky behaviors—into a dedicated group.

This allows organizations to focus on these high-risk individuals with adaptive security training, tailored simulations, and targeted awareness programs designed to modify their behavior and reduce vulnerabilities. By concentrating efforts on these specific employees, organizations can more efficiently allocate resources and significantly lower the likelihood of security incidents caused by human error.

Tracking Progress: The Role of Metrics

As illustrated in the image above, Keepnet’s executive reports provide a clear breakdown of repeat offenders in phishing simulations. In this example, 70% of users (120 individuals) are identified as repeat offenders, compared to 30% (40 users) who passed the simulations. Such insights are critical for understanding the effectiveness of your cybersecurity training programs and pinpointing areas for improvement.

The Picture 2 visually displays two essential metrics:

• Current Level: Represents the percentage of users in your organization who have repeatedly failed phishing simulations. These repeat offenders are individuals who have failed more than once, indicating a need for further security awareness.
• Protection Level Agreement (PLA): A fixed benchmark set at 5%, designed to help organizations strive for an optimal security awareness level by reducing repeat offenders.

Key metrics to monitor include:

• Click-Through Rates: Assess the percentage of employees clicking on simulated phishing emails to gauge initial risk levels.
• Repeat Offender Reduction: Track progress in reducing the number of employees who fail multiple simulations, focusing on targeted interventions for these individuals.
• Training Effectiveness: Use post-training feedback surveys and quizzes to evaluate knowledge retention and comprehension of phishing threats.

By leveraging data-driven insights like those from Keepnet’s repeat offender reports, organizations can refine their approach to managing and mitigating human vulnerabilities. Learn more about these strategies in our blog on Managing Repeat Clickers in Cybersecurity.

How Keepnet Can Help You Address Repeat Clickers

Managing repeat clickers requires a combination of advanced tools, targeted training, and data-driven insights—all of which Keepnet Labs provides. Our solutions are designed to fortify your human firewall by identifying vulnerabilities, mitigating risks, and building a culture of cybersecurity awareness.

• The Phishing Simulator empowers organizations to run dynamic simulations, helping employees recognize and respond to real-world phishing threats like quishing and vishing.
• With Security Awareness Training, you can deliver customized modules that cater to your team’s unique needs, improving their engagement and retention.
• The Keepnet Human Risk Management Platform offers comprehensive behavioral analytics, enabling organizations to isolate repeat offenders and implement tailored interventions.
• Keepnet helps you to create Security Behavior and Culture Metrics by providing actionable insights into employee behaviors and attitudes towards cybersecurity. With Keepnet, you can track, measure, and enhance your organization's security culture, ensuring continuous improvement and risk reduction. See example culture metrics below:

Table 1: Security Behavior and Culture Metrics

Keepnet not only helps reduce click-through rates but also enhances the overall effectiveness of your cybersecurity strategy. Let us help you transform your team into your strongest line of defense against phishing threats.

Ready to take control of repeat clickers?

Further Resources

For deeper insights into managing repeat clickers and improving cybersecurity awareness, explore the following resources:

1. Top 11 Essential Security Awareness Training Topics of 2024
2. Unveiling the Anatomy of Vishing in 2023
3. Understanding Smishing: What It Is and How to Prevent It
4. Discovering Keepnet Labs’ Data Breach Solutions
5. Why Is Vishing Awareness Training Essential for Every Employee?
6. Guarding the Gates: How MFA Phishing Simulations Reinforce Digital Walls
7. The Importance of Collaborative Defense in Cybersecurity

Watch the video below to see how our executive reports help address repeat clickers in phishing simulations

Editor's note: This blog was updated on January 22, 2025