# How a Global Consulting Firm Fixed Its Phishing Simulation Accuracy and Reduced Human Cyber Risk Source: https://keepnetlabs.com/blog/how-a-global-consulting-firm-fixed-its-phishing-simulation-accuracy-and-reduced-human-cyber-risk Published: 2025-05-02 Updated: 2026-10-04 Author: Ozan Ucar, Founder and CEO of Keepnet Category: Phishing Simulation > Learn how a global consulting firm stopped fake phishing clicks from bots, fixed inaccurate reports, and reduced human cyber risk with Keepnet’s secure behaviour management platform. A leading global consulting firm with **45,000+ employees worldwide**was running a highly advanced cybersecurity operation. With a complex enterprise infrastructure, Microsoft Office 365, and layered email defenses, including Proofpoint and a robust internal Security Operations Center (SOC), the organization was well-equipped to fend off external threats. Yet, when it came to **phishing simulations and security awareness training**, they faced a hidden and costly problem: **inaccurate simulation data**. This blog post explores how they identified the issue, transformed their simulation accuracy, and reduced human cyber risk with Keepnet. ## The Hidden Challenge: Ghost Clicks and Inaccurate Metrics Despite fully whitelisting phishing simulation IPs and domains across Microsoft Defender and third-party tools, the organization continued to see inaccurate results in its phishing simulation reports. - Users were reported as having **clicked on phishing links without opening the emails**. - Simulation results were **filled with misleading data**, making them unreliable and hard to act upon. - Even with full whitelisting across Microsoft Defender, sandboxes, and Proofpoint, the problem persisted. These false positives, caused by automated systems pre-analyzing emails, led to **distrust in the metrics**. Security teams couldn’t confidently measure user behavior, which **undermined compliance efforts and reduced program effectiveness**. To learn how to avoid misleading results and set metrics that reflect real user behavior, explore the Keepnet article: [How to Set the Right Security Awareness Metrics to Protect Your Organization](https://keepnetlabs.com/blog/what-are-the-metrics-for-evaluating-security-awareness-efforts). ## The Turning Point: A Proof of Value with Keepnet Frustrated with unreliable data and growing pressure to meet compliance standards, the firm turned to **Keepnet** for a Proof of Value (PoV). The goal is to test whether Keepnet’s solution could provide clarity and accuracy where others have failed. What they found was transformative: - **100% elimination of bot clicks** from security tools like Microsoft Defender, AI scanners, and sandboxes. - **No need for extensive whitelisting**, which reduced time and operational complexity. - **Accurate reporting based on real user interactions**, not system-generated artifacts. Keepnet's platform instantly resolved their most critical issue,**trust in the data**. To see how advanced reporting can pinpoint high-risk areas in your organization, check out the Keepnet guide on [Executive Reports: Companies with the Highest Risk Scores](https://keepnetlabs.com/blog/executive-reports-companies-with-the-highest-risk-scores). ### The Outcome: Reliable Compliance and Measurable Human Risk Reduction The results of the PoV were so compelling that the organization quickly adopted Keepnet as its go-to [phishing simulation](https://keepnetlabs.com/products/phishing-simulator) and [security awareness tool](https://keepnetlabs.com/products/security-awareness-training). With Keepnet, they: - [Achieved compliance](https://keepnetlabs.com/blog/the-ultimate-guide-to-security-awareness-compliance-requirements-frameworks-and-best-practices) by accurately measuring human response to phishing. - **Protected their brand and reputation** with data they could trust. - Shifted focus from technical troubleshooting to **driving behavior change and risk reduction**. Keepnet’s seamless compatibility with Microsoft environments and its ability to filter out non-human interactions gave their cybersecurity team the confidence and clarity they had been missing. ### Facing False Clicks with Your Current Awareness Provider? Let’s Fix That. Many security teams using platforms like KnowBe4, Hoxhunt, and Proofpoint face a critical challenge: **bots and email security tools auto-click phishing links**, generating false positives. These non-human clicks distort simulation results, making it nearly impossible to measure real user behavior, and creating endless whitelisting headaches. ### Keepnet eliminates this problem at the root [Keepnet's platform for human risk management and secure behaviour management](https://keepnetlabs.com/) uses advanced bot detection and filtering technology to ensure that only real user interactions are recorded, no clicks from sandboxes, AI scanners, or security gateways. This means: - **100% human-verified reporting** - **No more wasted hours managing whitelists** - **Accurate insights you can use to improve user behavior and meet compliance goals** With Keepnet, you don’t just run simulations, you get **clean, actionable data** that drives real risk reduction. To understand how to identify and manage users who repeatedly fall for phishing attempts, explore the Keepnet article: [Executive Reports: Insights on Repeat Clickers in Phishing Simulations](https://keepnetlabs.com/blog/executive-reports-insights-on-repeat-clickers-in-phishing-simulations). ***Editor's Note: This article was updated on March 12, 2026***. ## What Better Program Design Looks Like How a Global Consulting Firm Fixed Its Phishing Simulation Accuracy and Reduced Human Cyber Risk works best when the content reflects how people actually make decisions. Strong programs do not try to teach everything at once. They focus on the few behaviors that create the most risk, then reinforce them with current examples, timely reminders, and clear reporting paths. That is also what makes training easier to defend internally. When a program changes behavior, reduces repeat-risk patterns, or improves reporting quality, leaders can see how awareness supports real business outcomes instead of acting like a standalone compliance activity. Keepnet teams usually see the biggest gains when training is tied to a reporting path and a follow-up workflow. For most organizations, the common mistake is treating how a global consulting firm fixed its phishing simulation accuracy and reduced human cyber risk as content delivery instead of behavior design. ### Program Checklist - Choose the user decisions that matter most instead of covering every possible topic. - Use short modules, current examples, and realistic follow-up after incidents or simulations. - Measure reporting, repeat risk, and remediation behavior, not only completions. - Give managers and team leads a role in reinforcing the habits you want to build. ## Frequently Asked Questions ### What are ghost clicks in phishing simulations? Ghost clicks, also called false clicks, are recorded by automated systems such as security scanners and link checkers rather than by a person, which inflates the fail rate. ### Why do false clicks matter? They send employees to remedial training they did not earn and make the reported risk figure wrong. Once the numbers are visibly wrong, the credibility of the whole programme goes with them. ### How do you tell a real click from an automated one? Timing, user agent and request pattern. Clicks arriving seconds after delivery, several from one recipient at once, or hits from data centre addresses are machine activity rather than human. ### How are false clicks eliminated? By detecting bot behaviour at the phishing URL and excluding it before it is counted, rather than trying to explain the inflated number afterwards. ### What changes once the metrics are accurate? Training targets the right people, the trend becomes meaningful, and compliance reporting stops overstating exposure. Accuracy is what makes the rest of the programme defensible. ### What should a buyer ask a vendor about this? How automated traffic is identified, whether excluded clicks are visible in reporting, and what the click definition actually is. Vendors count this differently, which is why benchmarks are hard to compare.