A Clicking Time Bomb: What To Do About Repeat Clickers

The report examines the risk posed by “repeat clickers” in phishing simulations and real attacks, citing research that they comprise less than 1% of users yet are 10x more likely to click, and noting traits such as overconfidence, low skepticism, forgetfulness, and rigid email habits. It argues punishment is ineffective and recommends personalized conversations, AI-driven human risk management, behavior-disrupting tools (e.g., link confirmation and time-of-click URL analysis), inbox noise reduction, targeted training, and positive incentive programs to reduce organizational risk.