A gotcha email that shames the people who click teaches nothing. Here is how we run a phishing simulation that measures human risk and moves the numbers that matter: report rate, dwell time, and repeat clickers.