Companies may be measuring phishing resilience the wrong way
Pistachio's 2026 report analyzing 648 organizations finds click rates alone mislead; combining clicks, credential submission, and reporting better measures phishing resilience.
Pistachio's Phishing Behaviour Report 2026 analyzed 648 organizations and 123,692 users across 354,962 simulations between June 1, 2025 and May 31, 2026. It found click and credential-submission rates rose during the first six months of training before declining, and from the six-month peak to the 12-month stage clicks fell 27% while credential leaks dropped 41%. The report-to-click ratio increased from 1.3 at three months to 1.8 at 12 months, framing employees as an active detection channel. Departmental analysis showed Construction had the highest cumulative click rate (41.31%) and Health the lowest report rate (13.17%), supporting more targeted training.
- Click rates alone create a false sense of security; credential submission and reporting behavior are stronger resilience indicators.
- From month six to twelve, clicks fell 27%, credential leaks dropped 41%, and reports declined 19%.
- Construction showed the highest click rate (41.31%) and credential leak rate (16.47%) across 16 departments.
- Reused familiar templates lower click rates via recognition without improving resilience against unfamiliar attacks.
From the original article
3 min read at helpnetsecurity.com
Companies that judge phishing simulation programs by how often employees click simulated attack emails may be overlooking more important indicators of cyber resilience, according to Pistachio’s Phishing Behaviour Report 2026. Examples of difficult simulations (Source: Pistachio) The analysis covered 648 organizations with a complete 12-month record and 123,692 users between June 1, 2025, and May 31, 2026.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.