Microsoft 365
Why do phishing simulations show clicks nobody made?
Updated
Short answer
Email security tools open links automatically to check whether they are safe. Microsoft Defender Safe Links scans URLs before delivery and can detonate unknown links in the background, and many gateways and sandboxes do the same. A phishing simulation that counts every link visit as a click will record these automated checks as people clicking, which inflates click rates and blames staff who never opened the email.
Why would a phishing simulation record a click nobody made?
A phishing simulation knows someone clicked because a request arrives at its tracking link. It cannot see who sent that request, only the request itself. If anything other than a person visits the link, it can look exactly like a click.
Email security products are built to visit links. Their job is to check where a URL leads before a person gets there. When they visit a simulation link, a basic platform records a click against the recipient, even if that person never saw the email.
The result is a false positive: a staff member is marked as having failed, may be sent remedial training, and the business sees a click rate that has little to do with real behaviour.
How does Microsoft Defender Safe Links check links?
Safe Links is part of Microsoft Defender for Office 365. Microsoft describes it as providing URL scanning and rewriting of inbound email during mail flow, plus time-of-click verification of links. The Built-in protection preset policy applies Safe Links to all recipients in organizations with at least one Defender for Office 365 licence, unless other policies cover them.
Microsoft's documentation describes several behaviours that matter for simulations.
- URLs are scanned prior to message delivery whenever Safe Links protection is on, whether or not they are rewritten.
- URLs that do not have a valid reputation are detonated asynchronously in the background.
- With real-time URL scanning on, the recommended setting holds messages until URL scanning is finished.
- When a user clicks a rewritten link, it is checked again before the page opens.
- Microsoft's own Attack simulation training uses Safe Links to track click data for simulation payloads.
What other tools open links in email?
Safe Links is not the only source of automated visits. Many small businesses have more than one layer of email security, and each can produce its own link visits.
- Secure email gateways that sit in front of Microsoft 365 and rewrite or pre-check URLs.
- Sandboxes that open links and attachments in an isolated browser to watch what happens.
- Endpoint and browser security tools that check a link when the message is previewed.
- Link preview features in some mail and chat apps that fetch a page to show a summary.
How do false clicks distort phishing simulation results?
Automated visits tend to arrive in bursts, often for many recipients at once and soon after delivery. On a small team, a single scanner sweep can make it look as though most of the office clicked.
This causes three practical problems. Click rates look worse than reality, so trends over time are unreliable. Individual staff are wrongly told they failed, which damages trust in the program. And the business may spend time on remedial training for people who did nothing wrong.
The UK NCSC warns that blaming users for clicks does not work and that simulations can erode trust. Telling someone they clicked when they did not is an easy way to lose that trust.
How can you tell a scanner from a real person?
No single signal is perfect, so reliable filtering combines several. Look at each link visit against what a person reading email would actually do.
- Timing: visits within seconds of delivery, or before the message could plausibly have been opened, point to automation.
- Patterns: every link in the message opened at once, or many recipients visited within the same moment.
- Network: visits from cloud hosting or known security vendor address ranges rather than the business's own internet connection or a mobile carrier.
- Browser: unusual or headless browser signatures, missing headers, or requests that never load the page's images and scripts.
- Follow-through: a person usually lands on the page and interacts with it. A scanner often fetches the page and leaves.
What should you set up to reduce false clicks?
Start with configuration, then use filtering for what is left. In Microsoft 365, configure the advanced delivery policy for your simulation vendor. Microsoft documents that for matching messages, Safe Links does not block or detonate the URLs at time of click, and Safe Attachments does not detonate attachments. URLs are still wrapped.
Advanced delivery does not cover every tool in the mail path, so third-party gateways may need their own allow settings. Do not add simulation URLs to the Safe Links Do not rewrite list, because Microsoft warns this might cause unwanted click alerts.
Finally, keep the raw events. When someone disputes a click, a per-person timeline showing each visit with its time, network and browser lets you settle the question with evidence rather than argument.
NetMinder Security, a white-label phishing simulation platform for MSPs, was built around this problem. Every link visit is checked for timing, browser and network signals, and known scanner ranges are filtered, so email security tools opening links do not count as clicks. Thresholds can be tuned per client, and every event is kept in a per-person timeline.