Phishing Research Challenges Conventional Security Awareness Testing
Pistachio's 2.47 million phishing simulations across 1,200 organizations show click rates alone mislead, with 30% of IT staff clicking and leak rates more predictive.
Between June 2025 and May 2026, Pistachio sent 2.47 million simulated phishing attempts to more than 123,000 employees at over 1,200 organizations, analyzing click, credential-leak and reporting behavior. Click rates ranged from 26% in Design to 41% in Construction; 30% of tech development and IT staff clicked at least once, while financial services were the most resilient sector. The report argues that click rate alone creates a false sense of security and that combined click, leak and report trends are better resilience indicators.
- On the first simulation, more users report than click, yet 1.57% still leak credentials.
- Tech development (30.3%) and IT (28.5%) users clicked at least once; financial services performed best.
- Click and leak rates rise during the first six months before declining, so programs must be sustained.
- By program end, users reported suspicious emails nearly twice as often as they clicked.
- AI-driven delivery matched lures to roles, completing in 12 months what manual testing would take 23 years.
From the original article
3 min read at securityweek.com
Analysis of 2. 47 million simulated attacks shows why organizations should measure credential leaks and reporting, not just clicks. The post Phishing Research Challenges Conventional Security Awareness Testing appeared first on SecurityWeek.
By Kevin Townsend · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.