Phishing Susceptibility Drops 79% After Year of Training, KnowBe4 Report Finds
Event summary
- KnowBe4's 2026 Phishing by Industry Benchmarking Report analyzed 42 million phishing simulations across 14.8 million users at 64,000 organizations worldwide.
- Global average Phish-prone Percentage (PPP) dropped from 33.2% to 4.2% after one year of security awareness training.
- Healthcare & Pharmaceuticals (42.7%), Insurance (38.1%), and Retail & Wholesale (36%) were the most vulnerable industries at baseline.
- Africa recorded the highest baseline risk at 35.9%, while Asia had the lowest at 24.9%.
- Phishing attacks spiked by 17% since late 2025, driven by AI-powered campaigns.
The big picture
KnowBe4's report underscores the critical role of ongoing security awareness training in mitigating phishing risks amid a rapidly evolving threat landscape. As cybercriminals increasingly exploit AI for personalized attacks, organizations must prioritize continuous employee education to reduce susceptibility. The findings highlight significant variations in baseline risk across industries and regions, emphasizing the need for tailored security strategies.
What we're watching
- Training Effectiveness
- Whether continuous personalized training can sustain low phishing susceptibility rates against evolving AI-driven threats.
- Industry Vulnerability
- How sectors like Healthcare and Insurance will adapt their security strategies given their high baseline phishing risk.
- AI-Powered Attacks
- The pace at which cybercriminals leverage AI to create more sophisticated phishing campaigns and social engineering attacks.
Related topics