Click Rate Is Not Intelligence: Measuring Human Risk by Mechanism, Not Magnitude

For three decades, security awareness has measured human risk with a single number: the click rate. The field advanced from open rate to click rate and then stopped, treating a count of who clicked as if it were a conclusion. This paper argues that the click rate is a data point, not intelligence — it reports that something happened without explaining why, and an explanation you cannot act on is not a diagnosis. Drawing on the behavioral-security literature, which has established for years that susceptibility to social engineering is a function of measurable psychological factors rather than technical ignorance, the paper identifies three structural blindnesses in the standard phishing report: it measures susceptibility to the click rather than to the attack; its sector benchmark compares outcomes without controlling for the pretext; and without naming the psychological mechanism, it gives training no target. It proposes a different unit of analysis — the principle the attacker pulls and the emotion it activates in the target — and locates it within a four-phase anatomy of attack, each phase carrying its own point of failure and therefore its own countermeasure. The argument is grounded in directional findings from a private corpus of custom-built social engineering campaigns, reporting the ordering and separation of effects rather than absolute magnitudes, and showing that these directions confirm rather than contradict the published literature. The claim is not that the click rate is wrong. It is that the field has been mistaking a thermometer for a diagnosis.