Click-through rate is the percentage of people who interact with a lure, such as opening a malicious link, downloading a file, or entering credentials after seeing a suspicious message. In cybersecurity, it is a practical measure of how persuasive a phishing email, text, ad, or fake login page is.
It matters because attacker success often depends on a single click that creates initial access. Defenders use click-through rate in phishing simulations to test awareness training, compare teams, and identify where users need more support. A lower rate can suggest better caution, but it should be read alongside report rate and response time. In real attacks, a high click-through rate means more exposed accounts, more stolen data, and more chances for malware or credential theft. As a defense metric, it helps organizations move beyond confidence and measure actual behavior under pressure.