More than 20% of users identified and reported phishing per engagement, including 11% of the users who did click the email.