A phishing simulation records only how many staff opened the message. Which additional measure best evaluates response behavior?

1. Only the total size of employees' mailboxes
2. Only the number of words in the simulation message
3. Whether the simulation used the corporate font
4. Whether recipients reported suspicious messages through the approved channel