In phishing defense, the reporting rate is the share of recipients who identify and flag a suspicious message through an approved channel, such as a mail client’s report button or a security team inbox. It measures a protective response, rather than simply whether someone clicked a link.
During a phishing simulation, tracking reports alongside clicks and credential submissions gives a fuller picture of user behavior and the organization’s response process. A higher reporting rate can help defenders detect real campaigns sooner, while a low rate may reveal gaps in training, reporting tools, or procedures. Interpret the metric in context: define what counts as a report, who received the simulation, and how quickly reports were made.