Emails in local languages that mention real government agencies and banks get several times more clicks. Data from our cyber exercises.
During cyber exercises, we regularly run controlled phishing campaigns. The same scenario in English gets noticeably fewer clicks than a Russian or Uzbek version with correct terminology and references to familiar organizations.
Three themes work best: accounting notices about salaries and bonuses, demands from a "regulator" to submit documents by a deadline, and delivery or customs clearance messages. They share two things: time pressure and external authority.
Another metric matters more than the click rate itself: how many employees reported the suspicious email. In organizations without an awareness program, only a handful do, and the security team is the last to learn about the attack.
The right maturity metric is not "zero clicks" but a short time to the first phishing report. You get there through regular simulations with debriefs, not a one-off lecture to tick a box.