Before and after simulation, 3,200 staff, six departments

Cybersecurity research poster example

A phishing study poster is usually read from its numbers down, so this board opens with four of them across the top: 3,200 staff, two campaigns, a click rate that fell from 18.4% to 9.1%, and a report rate that rose from 12% to 31%. Everything under the strip explains how those four were produced.

Create a poster with OneCraftA0 Portrait, printed at 841 by 1189 millimetres

The whole board

The poster at full size, exactly as it prints. Every number, citation and caption on it was written for this example, so the layout is being judged on real content.

PU
Does a 20 minute module change what staff click? Two simulated phishing campaigns across 3,200 people
R. Oyelude ¹, C. Vanterpool ¹, Y. Sasaki ²
1 Security Research Group, Penhallow University · 2 Information Services Division, Penhallow University
3,200
staff in both campaigns
Every employee with a mailbox, six departments
18.4% to 9.1%
click rate, first to second
589 clicks then 291, a fall of 9.3 points
12% to 31%
report rate, first to second
384 reports then 992, a rise of 19 points
6 weeks
between the two campaigns
Module delivered in week 3, lures matched for difficulty
Abstract
Security awareness training is bought on the promise that fewer people will click, and the promise is rarely tested on the people who bought it. This study ran two simulated phishing campaigns six weeks apart across all 3,200 staff of one organisation, with a 20 minute module delivered in between. Lures were matched for difficulty by an independent reviewer who did not know which campaign each belonged to. Click rate fell from 18.4% to 9.1% and the share of staff who reported the message to the security desk rose from 12.0% to 31.0%. The reporting change is the larger of the two and the one the operations desk noticed, because a message reported at 11 minutes can be pulled from every other mailbox before most of them are opened. Department rates in the second campaign ran from 4.6% clicking in Engineering to 14.2% in Sales, and 118 of the 291 people who clicked had also clicked six weeks earlier.
Introduction
Most published evaluations of phishing training report a click rate and stop, which leaves the question a security desk actually asks unanswered: does anyone tell us? A click is a failure that the desk learns about late, from a log. A report is a success that arrives in minutes and lets the desk pull the message from every other mailbox before it is opened. The two numbers move for different reasons and a programme can improve one without touching the other, so both were collected here from the start. The second design choice was to match the lures. A campaign that follows training with an easier message will show an improvement that belongs to the message, not to the staff, and matched difficulty is the cheapest defence against that.
METHODS
Population. All 3,200 staff with a mailbox: Engineering 840, Operations 640, Sales 520, Support 460, People 460 and Finance 280. Nobody was excluded.
Campaigns. Two simulated phishing campaigns six weeks apart, each a single message sent to every mailbox over one working morning.
Lures. Matched on sender plausibility, pretext, link disguise and spelling by a reviewer blinded to which campaign a lure belonged to.
Module. One 20 minute online module in week 3, covering link inspection, sender checks and how to report. Completion was 3,061 of 3,200.
Measures. Click on the link, and report to the security desk within 24 hours. Both taken from the platform log, not from self report.
REFERENCES
1.Tewelde, M. and Kohn, B. (2025) Report rate as the outcome a security desk can use. Journal of Security Operations, 13(2), 77 to 95.
2.Falzon, G. (2024) Matching lure difficulty across simulated phishing campaigns. Applied Human Factors in Security, 6(4), 311 to 329.
3.Sasaki, Y., Oyelude, R. and Vanterpool, C. (2026) Repeat clickers: who they are and what a module does not reach. Penhallow Security Reports, 4(1), 18 to 34.
Clicked
Reported
Finance
Ops
Sales
Support
Eng
People
015304560
Figure 1. Click rate and report rate by department, second campaign. Departments are Finance, Operations, Sales, Support, Engineering and People.
Source: two simulated campaigns, 3,200 staff, 2026.
Results
In the first campaign 589 of 3,200 staff clicked the link, 18.4%, and 384 reported the message, 12.0%. In the second, 291 clicked, 9.1%, and 992 reported, 31.0%. Clicks fell by 9.3 points and reports rose by 19.0 points, so the ratio of reports to clicks moved from 0.65 to 3.41. Department rates in the second campaign ranged from 4.6% clicking in Engineering to 14.1% in Sales, and reporting ran the other way, from 46.3% in Engineering down to 20.4% in People. Counts behind those rates, out of department sizes of 840, 640, 520, 460, 460 and 280, are 39, 73, 74, 45, 42 and 18 clicks and 389, 157, 110, 135, 94 and 107 reports. Of the 291 who clicked in the second campaign, 118 had also clicked in the first, so 173 were new. Median time to the first report fell from 46 minutes to 11 minutes, and the desk had a purge running before the ninth click in the second campaign.
Discussion
The clean reading is that clicks roughly halved and reports roughly tripled, and the second is worth more than the first. A report at 11 minutes lets the desk purge the message from 3,200 mailboxes before most of them are opened, which is a control that does not depend on anyone being careful. The uncomfortable reading is that 118 people clicked twice, six weeks apart, after a module that 96% of staff completed, and a programme that treats those people the same as everyone else will keep producing them. Two limits belong on the board. One organisation and one module cannot separate the module from the fact that staff had been phished six weeks earlier, and a matched lure is a judgement by one reviewer, not a measurement.
Key finding
Clicks halved, from 589 staff to 291, and reports rose 2.6 times, from 384 to 992, after one 20 minute module.
Click rate 18.4% to 9.1%, a fall of 9.3 points on 3,200 staff
Report rate 12.0% to 31.0%, reports per click 0.65 to 3.41
Median time to first report fell from 46 to 11 minutes
118 of the 291 second campaign clickers had clicked before

Block by block

What each block on the board is for, in the order a reader walks it.

Title band and three authors
The title asks the question the study answers and names the population and the intervention, so the stat strip underneath is read as evidence rather than as claims.
Stat strip, four numbers
Population of 3,200 staff, the six week gap between two campaigns, click rate 18.4% to 9.1% with the counts 589 and 291, and report rate 12% to 31% with the counts 384 and 992.
Abstract
The design in four sentences: two matched campaigns, one module between them, blinded lure matching, and why the reporting change mattered more to the operations desk than the click change.
Introduction
Why a click and a report move for different reasons, why a desk learns about a click late and a report early, and why lure difficulty was matched by a reviewer who did not know which campaign a lure belonged to.
Methods as a labelled protocol
Five entries: the 3,200 mailboxes and the department sizes, the two campaigns and their delivery, the blinded lure matching, the 20 minute module with 3,061 completions, and the two log based measures.
Figure 1, both rates by department
Click rate and report rate for the six departments in the second campaign, with short department labels and two short series names so the tick row stays clear of the legend band underneath.
Results and discussion
Both campaigns in counts and rates, the reports per click ratio, department ranges, the 118 repeat clickers, and the median report time falling from 46 minutes to 11.
Key message, four points and references
A callout carrying the halved clicks and the 2.6 times reporting rise, a four item checked list, and three numbered references at the foot of the column.

What makes this board work

Four stat blocks carry the whole result

The strip across the top gives the population, the design, the click change and the report change, each with its detail line underneath. A reader who stops after three seconds still leaves with the two rates and the fact that 3,200 people were involved.

Reporting is treated as the real outcome

Most phishing evaluations report clicks and stop. This board reports both and argues for the second, because a message reported at a median of 11 minutes can be pulled from every other mailbox, and the reports per click ratio moving from 0.65 to 3.41 is the operational number.

The uncomfortable count is on the board

Of the 291 people who clicked in the second campaign, 118 had clicked in the first. Putting repeat clickers in the checked list, rather than only in the discussion, is what stops the poster reading as a training advertisement.

Questions people ask

What goes on a cybersecurity research poster?

The population and how it was selected, the design including what was matched between conditions, the intervention in enough detail to repeat, the measures taken from logs rather than self report, and the results with counts. Anything that weakens the finding, such as repeat clickers, belongs on the board.

Should a phishing poster report clicks or reports?

Both, and say which one the security desk uses. A click is a failure learned about late from a log. A report is a success that arrives in minutes and lets the desk purge the message. This board carries both rates and the ratio between them, which moved from 0.65 to 3.41 reports per click.

How do I keep a before and after comparison fair?

Match the lures. A second campaign with an easier message shows an improvement that belongs to the message. Here a reviewer blinded to campaign order matched on sender plausibility, pretext, link disguise and spelling, and the board says so in the methods rather than leaving a reader to assume it.

How many numbers should a stat strip carry?

This design carries four, each with a value, a label and a detail line. Four is the practical limit at this width before the values start shrinking, and twenty seven of the forty poster designs carry a stat block of some kind, so check how many yours has before planning the opening numbers.

How do I stop chart labels colliding at A0?

Use short category labels and short series names, and prefer an even number of categories. The series legend sits in the bottom margin next to the axis tick labels, so a long label near the centre of the plot will meet it. This figure uses six one word department names for exactly that reason.

What does an A0 portrait poster export at?

The working canvas is 1,656 by 2,340 pixels and the export captures at twice that, giving 3,312 by 4,680 pixels, which is about 100 dots per inch at full A0 size. The file is RGB with no bleed, no crop marks and no CMYK conversion, so a commercial printer will prepare those separately.

Build your own in about a minute

The button below opens the generator with this use case already described. Change the wording to match your own, generate, then edit anything you like.

Make one like this

Other poster examples

Robotics research poster example

A robotics poster has to show the method as a sequence before it shows a result, because the result only means something once the reader knows what the robot does at each step. This board runs map, plan, detect, replan and execute across the top as a five stage chain, then gives run times at three obstacle densities underneath.

Electrical engineering research poster example

A bench test poster is only useful if the reader can see the whole curve, not the peak. This board runs one 5 kW inverter across five load points on three firmware versions, plots conversion loss rather than efficiency so the differences are visible, and shows that the same 0.9 point gain holds at 30% of rated load, where a rooftop array actually sits.

Civil engineering research poster example

A structures poster has to make a reader trust twelve specimens, which means the casting, the rejections and the failure mode all belong on the board. This one runs seven narrow columns across A0 landscape, from abstract to references, with the specimen flow and the load results in the middle where a reviewer will look first.

Want the steps in the builder? Read Add charts and diagrams, then choose the template, theme and size. For everything this generator can do, see the poster maker.

Sources

Written and checked by the OneCraft team. Last checked .