Consolidated Training and Phishing Reports for MSPs

An MSP running security awareness for thirty client companies faces an unglamorous problem: proving the program works means logging into thirty tenants, exporting thirty spreadsheets, and stitching them together the night before every quarterly business review. empowsec removes that grind with reseller-level analytics that aggregate every company under your reseller account into a single consolidated report.

This article walks through what the consolidated view contains, why the phishing block includes a metric most platforms skip, and how the reporting engine is built to stay fast whether you manage five tenants or five hundred.

One Consolidated View Across Your Whole Portfolio

The reseller reports page pulls together all companies under your reseller account in one screen. A date-range filter at the top controls the reporting window and defaults to the last three months, so opening the page immediately shows a QBR-ready quarter. Narrow it to a single month for a campaign retrospective or widen it to a year for an annual review - the training and phishing blocks below recalculate for the selected window.

Every number exists at two levels: an organization-wide total across your whole portfolio, and a per-company breakdown that shows exactly which clients drive the trend. That combination matters for MSPs, because a healthy portfolio average can hide one client whose program has quietly stalled.

Training Numbers That Hold Up in a QBR

The training block reports total assignments, completed, in progress, and overdue counts for the selected date range, plus the resulting completion rate. Below the totals, the per-company breakdown lists each client with its assignments and completions in the window alongside an all-time completion rate.

That all-time rate is deliberate. A client that assigned very little training this quarter would otherwise look either perfect or terrible depending on a handful of assignments. The all-time completion rate anchors the conversation in the client's overall program health, while the date-ranged counts show current activity. Together they answer the two questions every client stakeholder asks: is the program moving, and is it working overall?

Phishing Metrics - Including the Reply Rate Most Tools Skip

The phishing block follows the same two-level pattern. For each company you see the number of campaigns and the emails sent and clicked within the date range, plus all-time click rate, open rate, report rate, and reply rate.

Reply rate deserves a special mention because it is a genuine differentiator. Many platforms only measure clicks, but modern business email compromise attacks often contain no link at all - the attacker simply asks the victim to reply, then escalates the conversation toward a fraudulent payment or a data request. empowsec tracks replies to simulated phishing emails as their own metric, so you can show a client not just who clicks links but who engages in conversation with an attacker. Pair a rising report rate with a falling click and reply rate and you have the cleanest possible story of behavior change.

Each company row also carries an overall risk figure: the average risk score of that company's users. Because the risk score condenses every phishing and training event into one behavioral number, this single column lets you rank your portfolio by exposure at a glance and decide which client gets the next targeted campaign.

Built to Scale Across Many Tenants

Consolidated reporting is only useful if it loads. A naive implementation would run a couple of queries per client company, which means a hundred-tenant MSP triggers hundreds of database round trips every time the page opens. empowsec batches the per-company statistics into aggregate queries instead - two queries where the naive approach would need two per company - grouping results by company in the database itself. The practical effect: the report stays responsive as your portfolio grows, and refreshing it during a live client call is not a gamble.

Exports for Client-Facing Reporting

The same data leaves the platform as cleanly as it displays. Reports export to CSV or PDF in four flavors - training, phishing, seats, and a combined summary - using the same date-range filter as the on-screen view. The CSV drops straight into your own BI tooling or a client workbook; the PDF is ready to attach to a QBR deck. Access follows the reseller permission system covered elsewhere on this blog: viewing reports and exporting them are separate permissions, so you can give an account manager read access without export rights if your data-handling policy requires it.

Key Takeaways

• One view, whole portfolio: reseller analytics aggregate every client company, with a date-range filter defaulting to the last three months.
• Two-level training metrics: org-wide assignments, completed, in progress, overdue, and completion rate, plus per-company counts with all-time completion rates.
• Phishing depth per client: campaigns, sent, and clicked in range, plus all-time click, open, report, and reply rates.
• Reply rate is a differentiator: it surfaces conversation-based social engineering risk that click tracking alone misses.
• Risk at a glance: each company's overall risk is the average of its users' risk scores, making portfolio triage a single sorted column.
• Batch-aggregated queries keep the report fast across many tenants, and CSV or PDF exports make the numbers QBR-ready.