For years, we’ve measured the success of security awareness by a single, flawed metric: the phishing click-rate. We send fake emails, track who clicks, and pat ourselves on the back…