In cybersecurity, "phished" describes a person who fell for a phishing attempt. The term does not necessarily mean a confirmed intrusion; there may have been exposure without verified compromised access.
For IT teams, CISOs, and compliance groups, the operational reading should focus not on the "event" alone but on the specific action and the level of exposure. That is why it is recommended to measure clicks, credential submission, and reports, and to adjust the analysis based on the lure’s difficulty using NIST Phish Scale.
The sources cited by the material present metrics and practices for simulation and awareness campaigns, but they also show mixed results on effectiveness. As a result, it is not appropriate to assume a universal impact rate or to treat "phished" as a synonym for a confirmed breach.