Phishing resilience is measured best by clicks, credential submissions, and reporting together. Click rates alone can mislead, and results vary by department and over time. #Phishing #RiskMetrics #ITSecurity