Measure reporting first
A falling click rate is easy to achieve by sending easy tests. The behaviour you want is a person noticing a suspicious message and reporting it. Track how many simulated messages were reported and how quickly.
Design the programme
Treat simulations as a recurring programme with variety, not as a single annual event.
- Vary the lures: invoices, shared documents, delivery notices and internal requests.
- Match scenarios to the roles that actually receive them.
- Give immediate, short feedback after a click, with one thing to look for next time.
- Report results to managers as group trends, not as lists of names.
Protect trust
If employees feel tricked or punished, they stop reporting. Agree the approach with HR and legal in advance, publish what the programme is for, and make it easy to report real emails so that the simulation and the real process feel the same.