Should You Punish Employees Who Fail Phishing Simulations?

No. A simulation click measures how hard that email was for that person on that day. It doesn't mean they failed. Punishment teaches people to hide mistakes, and the fastest defense against a real attack is someone who reports quickly, even right after they click. Save consequences for refusing policy, not for being fooled.

The question keeps coming back

Brian Krebs asked it in 2019 in Should Failing Phish Tests Be a Fireable Offense? Vendors still hand out consequence ladders: a warning, a manager meeting, then HR. It feels fair. If someone keeps clicking, shouldn't something happen?

The trouble starts with the word "fail."

A click is a measurement

Click rates track the email more than the person. NIST built the Phish Scale (Steves et al., 2020) because clicks swing with how hard a message is for its audience. Rozema and Davis tested this across 12,511 employees in 2026. Easy simulations drew about 7% clicks. Hard ones drew about 15%. Training had no significant effect on clicks or reports. Difficulty did (Rozema & Davis, WWW '26).

So if someone clicked in March and not in April, did they improve, or was April's email easier? Most programs can't say. Disciplining a person on that number means disciplining them for the template you picked.

What most people call a phishing test isn't really a test of knowledge either. Lain et al. (2024) concluded phishing looks more like an attention problem than a knowledge problem.

What punishment actually buys

Here is the trade. A threat of discipline may make people a bit warier, and clicks may dip. It also teaches a lesson nobody meant to teach: don't admit it.

That lesson is expensive, because reporting is the behavior that stops real attacks. In a 15-month study of more than 14,000 employees, Lain et al. (2022) found employee reports worked as a fast, sustainable detection system. Rozema and Davis found that in 36% to 55% of simulations, a report arrived before the first click. One early report lets your team pull a message from every inbox. That is why we treat Suspicious Email Reporting Rate (SERR) as the number that matters, and why the reporting race beats the click race.

Fear works against reporting. Amy Edmondson's 1999 research found team psychological safety predicts learning behavior, including admitting errors (Edmondson, 1999). In a university hospital, Tolsdorf et al. (2025) saw some staff react to simulations with fear, shame, guilt and hostility. Add a write-up policy and picture the accounts payable clerk who clicks a real invoice scam at 4:55 on a Friday. Do they call IT, or close the tab and go home?

People mostly report to protect the organization and their coworkers (Burda et al., 2025). Punishment swaps that motive for self-protection.

A fair caveat: none of these studies measured a punishment policy's direct effect on reporting. The case rests on what predicts reporting and admitting errors, and all of it points away from fear. Angela Sasse put it in a paper title: "Scaring and bullying people into security won't work" (Sasse, 2015).

The honest counterpoint

Sanctions do work on something. D'Arcy, Hovav and Galletta (2009) found perceived sanctions deterred intentions to misuse information systems. That's why policies need teeth.

But misuse is a choice. Being fooled isn't. Deterrence works on decisions, and nobody decides to fall for a well-built pretext.

Even the gentle version of punishment flops. Lain et al. (2022) found that mandatory embedded training after a click did not improve resilience and could increase susceptibility. If a training page backfires, a warning letter has little hope.

Where the line belongs

Consequences belong to refusing policy, after people know the rule:

• turning off MFA, or reading an MFA code to someone over the phone
• skipping the required callback before changing a vendor's bank details
• forwarding work email to a personal account
• installing software IT already said no to

Clicking a simulation does not belong on that list. Neither does entering a password into one, or clicking a real phish and reporting it. The person who clicks and reports within two minutes did the most useful thing left to do. Teach what to do after clicking a phishing link and make it safe.

What to do with employees who click more than once

Treat it as a diagnosis, not a verdict.

Start with which tactic gets them. Authority? Urgency? Package delivery? The pattern tells you what to talk about.

Then check difficulty. If one person keeps seeing your hardest emails, you're measuring the template. Rate your simulations with the Phish Scale and give them a fair read.

Coach privately and briefly. Lain et al. (2024) found the benefit of follow-up training came from the periodic reminder, not the content, and delayed training worked as well as immediate. A short, friendly chat a few days later does the job without a shame screen. Wash and Cooper found story-based advice landed much better coming from a peer (2018). And Yin et al. (2026) found feedback to all employees after a simulation looked more promising than feedback only for clickers, so share the debrief with everyone.

Last, look at the process. If an AP clerk clicks every fake invoice, maybe one person can approve and pay an invoice with no second check. A callback rule fixes that. A warning letter doesn't. Tolsdorf's hospital study found technical measures worked best.

Gartner analyst Elizabeth Davis put it this way in June 2026: "The goal is not security awareness, but secure habits" (Gartner).

How Hook handles it

Hook Security is a security awareness training and phishing simulation platform built for MSPs and SMBs. Our approach, Psychological Security (PsySec), treats clicks as learning moments and measures programs by SERR. Autopilot runs training and simulations each month, and the follow-up is short, humor-first video from Hook Studios, so nobody dreads it.

FAQ

Should employees be fired for failing phishing simulations?

No. A simulation click mostly reflects how hard the email was. Firing someone for it teaches everyone else to hide real mistakes. Reserve discipline for people who knowingly refuse security policy.

What do you do with an employee who clicks every phishing simulation?

Find the tactic that gets them, check whether they're seeing unusually hard emails, and coach them privately. Then look for a process gap, like invoice approvals with no second check.

Does punishment reduce phishing click rates?

It might lower clicks a little, but no study we cite isolates that effect. The cost is reporting, and reports are what let your team stop a real attack fast.

Should phishing simulation results go in performance reviews?

No. Results depend on which emails each person received, so they don't compare people fairly. Put security policy compliance in reviews instead.