Click-rate is the percentage of recipients who interact with a simulated phishing message, usually by clicking a link or opening an attachment. Security teams use it as a basic awareness metric because it shows how often a lure gets attention under realistic conditions.
In cyber security, click-rate matters because a single interaction can be the first step toward credential theft, malware delivery, or account compromise. But it is only one signal: a low click-rate does not prove resilience, and a high click-rate does not always mean failure if reporting is fast and defenses block the payload. Mature programs pair click-rate with other measures, such as report rate, response time, email filtering, and containment. In real attacks, the same user behavior that raises click-rate in a simulation can give an attacker an opening; in defenses, the metric helps identify training gaps and validate layered controls like DMARC and phishing-resistant MFA.