Comment Click-through is the wrong thing to measure (Score 2) 151
The experiment, and typical phishing training in general, measure click-through on email links. They use that measure because it is technically easy - you just need to create a fake email, not an entire fake website, and all phishing scenarios can be handled in the same way. The problem is that people frequently get emails with links they do have to click on, and this makes reliably distinguishing between legitimate emails and (well-crafted) phishing emails before clicking genuinely hard.
It is not clicking the link that is the problem, it is entering your credentials afterward, or downloading an executable (unless there is an unpatched browser vulnerability, but then we are not discussing phishing anymore). Use MFA and train your people to never enter their company credentials anywhere except on your organization's SSO sign-in that you have loaded from a bookmark or entered the URL for manually. Filter attachments. Use draconian endpoint security settings to prevent download/running of executables and train against that too. Have a policy of not using your work email (and computer) for personal purposes to reduce the likelihood of receiving a believable phishing email on a work account.
I hope to see training systems incorporate fake (AI-generated?) websites that try to capture credentials or trick the user into downloading "malware" so that we can get real statistics. Right now most of them are reporting what is easy to report, not what is meaningful.
Note: Preventing phishing of private personal information, such as bank account information, is an entirely different kettle of fish, but that is a social problem, not a workplace problem.