phishing-simulation-analysis

# Phishing Simulation Analysis ## Overview A phishing-simulation campaign is only as useful as the trend and pattern analysis built on top of its raw click data. A single campaign's click rate tells you almost nothing on its own; the trend across campaigns, and which specific users click repeatedly, are what actually drive training prioritization. This skill covers how to build that analysis across whatever simulation platform is connected, and how to optionally enrich it with real-world phishing-incident data when a technical security tool is also available — treating that enrichment as a bonus, never a requirement. ## Step Zero: Confirm What's Connected Call `conduit__search_tools` for phishing-simulation and click-data tools before assuming a specific vendor. KnowBe4 is the primary simulation platform in this marketplace. Proofpoint (`proofpoint__list_vap_users` and related tools) and Checkpoint Avanan (`avanan__list_threats` and related tools) both carry phishing-click or "Very Attacked Person" style signal alongside their core email-security function — where connected, they are secondary/optional sources of real-world click and attack-targeting data, not replacements for a dedicated simulation platform's controlled test results. Simulated-click data (from a simulation platform) and real-click data (from an email-security tool) are different things; never merge them into one number without labeling which is which. ## Key Concepts ### Click-rate trend over time Pull...