> Phishing metrics - what to track?

The results of phishing campaigns are often not comparable with each other over time. Various security vendors and red teams use different tooling and techniques - which is totally fine. However, I recommend requiring tracking a minimum set of metrics to be able to compare results over time. Funny side facts: At times employees are messing with the red team, entering invalid creds for CISO or CEO and things along those lines.