Phishing Awareness Metric: Best Measure of Employee Resistance
After three months of phishing awareness training, the security team wants a metric that best shows whether employees are becoming harder to trick. Which metric is MOST useful?
Quick Answer
The answer is the percentage of users who report suspicious messages before clicking links. This metric is the best measure of employee resistance because it directly captures the desired behavioral change: recognizing phishing indicators and using the reporting mechanism instead of engaging with the threat. Unlike click rates or training completion numbers, the reporting rate reflects proactive security action, which is the core goal of phishing awareness training. On the Security+ SY0-701 exam, this concept tests your understanding of security awareness metrics and how they differ from activity-based metrics; a common trap is choosing “number of training modules completed” or “phishing simulation click rate,” which measure participation or failure, not positive behavior change. Remember the memory tip: “Report, don’t click—that’s the trick.” This ties the metric directly to the desired outcome of reducing successful phishing by empowering users as a human firewall.
⚠ Common exam trap
CompTIA often tests the distinction between activity metrics (e.g., number of emails sent) and outcome metrics (e.g., reporting rate), and the trap here is assuming that more training or more simulations automatically means better security, when the real measure is behavioral change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The percentage of users who report suspicious messages before clicking links.
The percentage of users who report suspicious messages before clicking links directly measures the effectiveness of phishing awareness training in changing user behavior. A higher reporting rate indicates that employees are recognizing phishing indicators and using the reporting mechanism (e.g., an integrated phishing report button or email forwarding to a security mailbox) instead of falling for the trick. This metric focuses on the desired outcome—reducing successful phishing—rather than activity volume.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The total number of phishing simulation emails sent to employees.
Why it's wrong here
The amount of testing does not show whether employee behavior improved; it only shows how much training activity occurred.
- ✓
The percentage of users who report suspicious messages before clicking links.
Why this is correct
Reporting rate is a strong indicator of awareness and response behavior because it measures whether employees recognize and escalate suspicious emails instead of interacting with them. A higher reporting rate generally shows improved vigilance and faster detection, which is more valuable than simply counting how many simulated messages were delivered.
- ✗
The number of new usernames created in the email system.
Why it's wrong here
User account count has no meaningful relationship to phishing resistance or awareness outcomes.
- ✗
The average screen resolution used by employees during the campaign.
Why it's wrong here
Screen resolution is unrelated to awareness training effectiveness and does not measure user behavior.
Go deeper
Related to this question
Learn chapter
Security Policies and Procedures
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. After a phishing-awareness campaign, which metric best shows that employees are becoming more resistant to phishing attempts?
easy- A.The number of spam emails received by the mail gateway
- B.The average length of employee passwords
- C.The count of antivirus alerts on endpoints
- ✓ D.The percentage of users who click phishing test links
Why D: The percentage of users who click phishing test links directly measures behavioral change in response to simulated phishing attacks. A decreasing click rate indicates that employees are better at recognizing and avoiding phishing attempts, which is the primary goal of a phishing-awareness campaign.
Variation 2. After a phishing campaign, several employees entered credentials on a fake login page. Management wants a control that both improves user behavior and gives the security team a way to measure whether click rates are going down. Which two actions best meet that goal? Select two.
easy- A.Send a reminder email once a year and stop there
- ✓ B.Run role-based phishing awareness training
- C.Disable all external email for every employee
- ✓ D.Use simulated phishing exercises with reporting metrics
- E.Tell users to ignore suspicious messages unless IT calls first
Why B: Role-based phishing awareness training (B) directly improves user behavior by tailoring content to specific job functions, making the training more relevant and effective. Simulated phishing exercises with reporting metrics (D) provide a measurable way for the security team to track click rates over time, enabling data-driven assessment of improvement. Together, they address both behavioral change and quantifiable measurement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.