A failure criterion is the specific action or outcome that an exercise uses to classify a participant as having fallen for a simulated attack. In a phishing drill, this might mean clicking a link, opening an attachment, entering credentials, or failing to report the message. These actions carry different levels of security significance, so the criterion should be defined and documented.
Clear criteria make simulation results useful for improving defenses rather than creating a misleading score. For example, a click rate alone does not show whether credentials were submitted or whether users reported the message. Security teams should track relevant actions separately and interpret results in context, including the lure’s difficulty, the audience, and the exercise design. A failure criterion measures a response to a simulation; it does not, by itself, prove that a real compromise occurred.