[Reporting] Phishing reporting explained: email sent, opened, link clicked, submitted data

Use this article to understand what the phishing reporting metrics in Guardey mean and how to interpret them after a campaign.

Where to find phishing reporting

1. Sign in to the admin portal.
2. Open Phishing.
3. Open the campaign you want to review.
4. Check the campaign results overview.

Email sent

Email sent means Guardey sent the simulation email to the recipient’s email environment.

Good to know:

• Email sent does not guarantee inbox placement. The email can still land in spam/junk or quarantine.
• If delivery looks off, review your email security logs and confirm you completed whitelisting.

Next step

• [Deliverability] Whitelisting overview: what to whitelist for email delivery (link)

Opened

Opened means Guardey registered an email open event for that recipient.

Good to know:

• Opens can be affected by email client behavior and security settings, as it is tracked by a pixel in the email.
• An “open” is a weaker signal than a click or submitted data.

Link clicked

Link clicked means the recipient clicked the tracked simulation link in the email.

Good to know:

• A click indicates the user interacted with the call-to-action.
• In some environments, security tools can scan links automatically, which can create clicks that were not initiated by a user.

If you see clicks you cannot explain, use the troubleshooting article below.

Next step

• [Troubleshooting] Why do I see clicks when nobody clicked?

Submitted data

Submitted data means the recipient entered information on the landing page (for example, credentials) and submitted the form.

This is the strongest risk signal in phishing reporting, because it indicates a user went beyond clicking and took a high-impact action.

How to interpret it:

• Treat submitted data as the highest priority for follow-up awareness actions.
• Use it to identify high-risk teams, scenarios, or patterns.

How to interpret results at a high level

Use this order to assess risk:

1. Submitted data (highest risk)
2. Link clicked
3. Opened
4. Email sent (delivery indicator, not behavior)

Recommended comparisons:

• Compare results across groups to identify where extra training or communication is needed.
• Compare repeated campaigns over time to measure improvement.

When results look unexpected

If reporting does not match what you expect, use troubleshooting first. Common causes include email security behavior, client settings, or incomplete deliverability setup.

Next steps

• [Troubleshooting] Why do I see clicks when nobody clicked?
• [Deliverability] Whitelisting overview: what to whitelist for email delivery