Your Phishing Drill Numbers Are Lying to You
BankInfoSecurity, Wednesday, October 7th, 2026
A bank GRC leader explains why phishing-simulation click rates mislead and what behavior-focused programs measure instead.
IDFC First Bank's Uma Ramani argues that quarterly phishing drills measure how convincing a fake email was, not whether behavior changed, and that training effects fade within about six months without reinforcement.
Shaming people who click tends to cause disengagement, and research suggests reporting rates are a more honest metric than click rates.
She favors just-in-time coaching at the moment of a risky action and role-specific content, and floats AI voice coaching after a lapse as a promising but unproven idea.