Phishing susceptibility stays high until training becomes continuous

At a glance

What this is: Knowbe4's 2026 phishing benchmarking report shows that baseline susceptibility remains high, but a year of continuous security awareness training sharply reduces phish-prone behaviour.

Why it matters: IAM and identity governance teams should treat phishing resilience as a continuous behavioural control, because user trust decisions remain a front door to account takeover, delegated access abuse, and downstream identity compromise.

By the numbers:

• The global average Phish-prone Percentage stands at 33.2% before any security awareness training.
• A full year of continuous security awareness training reduces Phish-prone Percentage by 87% to 4.2%.

Context

Phishing susceptibility is a governance problem as much as a human behaviour problem. If a sizeable share of users will still engage with malicious email before training, then annual awareness campaigns are too blunt to serve as the primary control for identity-linked risk.

In this report, Knowbe4 treats phishing resilience as a measurable control outcome across industries, company sizes, and regions. The identity connection is direct: a successful phish often becomes the first step in account takeover, fraudulent consent, or misuse of legitimate access rather than a standalone email event.

Key questions

Q: Why does phishing susceptibility stay high even after awareness programmes start?

A: Because awareness decays when it is delivered as a one-off event instead of a continuous control. Users need repeated exposure, feedback, and reinforcement before risky behaviour changes in a durable way. In identity terms, the important measure is whether people stop making trust decisions that expose credentials, consent, or sessions, not whether they completed a course.

Q: When should security teams prioritise continuous reinforcement over annual awareness training?

A: Whenever the organisation faces fast-changing phishing, impersonation or pretexting risk, continuous reinforcement should take priority. Annual sessions create a time gap between learning and exposure, while short, timely nudges can influence behaviour at the point of decision. The more dynamic the threat, the less useful calendar-based training becomes.

Q: What are the signs that phishing awareness training is not working well enough?

A: Training is failing when employees still click, reply, or escalate suspicious messages without checking basic details first. Other warning signs include repeated responses to urgent language, weak reporting rates, and inconsistent use of verification steps for unexpected links or attachments. If people can describe threats but do not change behavior, the program is informative but not operationally effective.

Q: How should security teams reduce phishing risk in cloud identity environments?

A: Security teams should prioritise phishing-resistant authentication for the access paths that can reach sensitive cloud services, privileged consoles, and third-party integrations. MFA alone is not enough if the control can be bypassed, socially engineered, or inconsistently enforced. Combine device-bound trust, strong account lifecycle governance, and explicit exception management so stolen credentials do not become an easy path into cloud data.

Technical breakdown

Why phishing training decay matters to identity governance

Phishing training does not create a permanent immunity effect. User susceptibility changes over time, and the report's core finding is that the biggest improvements arrive after sustained reinforcement, not after a single onboarding or annual exercise. That reflects a basic governance reality: trust decisions are learned behaviours, and learned behaviours fade without repetition. In identity terms, the real control objective is not awareness completion but sustained resistance to credential theft, malicious consent, and deceptive login flows.

Practical implication: Treat phishing resilience as a continuous control with recurring measurement, not as a one-time training event.

How continuous training changes the control curve

Continuous security awareness works because it gives users repeated exposure to realistic prompts, feedback, and reinforcement. That changes the control curve from episodic intervention to ongoing behaviour shaping, which is why the report says the strongest gains arrive between month three and month 12. For IAM and PAM teams, this matters because phishing often targets the people who can approve access, reset credentials, or authenticate delegated actions. The security problem is not only the click, but the identity action that follows it.

Practical implication: Align training cadence with the credential and privilege events that phishers try to exploit.

Why AI-powered phishing increases the identity risk surface

AI-powered phishing narrows the gap between generic and convincing social engineering. More personalised messages raise the likelihood that users will trust a request, especially when the message is timed to an identity workflow such as login, verification, approval, or password reset. That makes phishing a broader identity assurance issue, because the attacker is no longer trying to defeat technology first. They are trying to manipulate the human trust decision that authorises downstream access.

Practical implication: Assume phishing will increasingly target identity workflows, not just inboxes, and test users accordingly.

Threat narrative

Attacker objective: The attacker wants to turn human trust into valid identity access that can be reused for account takeover, fraud, or lateral movement.

1. Entry begins with a phishing message that reaches a user during ordinary work and appears credible enough to prompt interaction.
2. Credential access follows when the user enters credentials, approves a malicious request, or exposes a session or consent token through the deceptive flow.
3. Impact occurs when the attacker uses that trusted identity path to access accounts, impersonate the user, or move into adjacent systems through legitimate privileges.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing resilience is now an identity control, not a comms programme. The report's numbers show that susceptibility is measurable, repeatable, and materially reducible only when training continues. That makes phishing defence part of identity governance because the outcome is access risk, not just user education completion. Practitioners should manage it with the same discipline used for access review and authentication policy.

Behavioural risk does not respond well to annual control design. Campaign-based awareness assumes a short-lived improvement cycle, but the report indicates that meaningful gains accumulate over months. That means the governance failure is not lack of content, but lack of continuity. Security teams should stop treating phishing as a seasonal exercise and start treating it as a standing control with lifecycle ownership.

AI-generated phishing creates a verification trust gap. As messages become more personalised, users lose the easy heuristics that once helped them spot fraud. The result is a broader boundary problem for IAM, because the point of compromise shifts toward trusted identity interactions such as login, approval, and consent. Practitioners should assume that identity workflows themselves will be targeted and design controls accordingly.

Continuous training is the named control concept this report validates. The practical lesson is not that awareness matters, but that susceptibility changes only when reinforcement is repeated long enough to change behaviour. That is a control-design issue, not a content issue. Security leaders should measure reduction over time, not training completion on its own.

Security teams should read these results as a warning about human identity fragility. A user base that remains phish-prone at baseline will not reliably support zero-trust style verification if the first trust decision is already compromised. The strongest programmes will link awareness, authentication hardening, and reporting feedback into one identity risk loop. Practitioners should govern the human layer as an active part of the identity perimeter.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Continuous training is the control variable that changes the human layer. The report reinforces a simple programme lesson: phishing susceptibility is not solved by one awareness event, because trust behaviours reappear unless they are repeatedly corrected. For IAM teams, this means phishing simulation, reporting feedback, and authentication hardening need to be governed together rather than treated as separate workstreams.

Human identity remains the easiest path into identity compromise. The article's baseline susceptibility figure is a reminder that access control can be undermined before technical controls are ever challenged. Security leaders should therefore treat user trust decisions as part of the attack surface and ensure their identity programme includes behavioural resilience, not just policy enforcement.

For practitioners

• Establish continuous phishing training cycles Run recurring training and simulation rather than annual or ad hoc campaigns, and track whether susceptibility falls over months rather than after the first exercise.
• Measure phish-prone percentage by segment Break results out by industry, company size, and region so that high-risk groups can be targeted with different reinforcement cadences and scenario types.
• Tie training to identity workflow failures Focus scenarios on password resets, consent prompts, login pages, and approval requests, because those are the points where phishing becomes access.
• Use AI to personalise reinforcement Adapt training content to the behaviours users actually fail on, so repeat exposure is more relevant than generic awareness messaging.

Key takeaways

• Phishing remains a material identity risk because many users will still engage with malicious messaging before any training has taken effect.
• A year of continuous reinforcement changes behaviour far more effectively than a single campaign or annual refresher.
• The practical response is to manage phishing as an ongoing control that protects credentials, consent flows, and privileged approvals.

Key terms

• Phish-prone percentage: Phish-prone percentage measures the share of users who click or otherwise respond incorrectly during simulated phishing tests. It is a behavioural metric that helps security teams baseline susceptibility, target training, and track whether awareness efforts are improving real-world judgment over time.
• Custom Security Awareness Training: Custom security awareness training is role based, risk aware education designed for specific users, teams, or threat conditions. Instead of broad annual lessons, it delivers timely guidance, simulations, and reminders that align with an individual’s access level, behavior, and likely attack exposure.
• Identity Workflow Automation: Identity workflow automation uses governed triggers and integrations to handle identity-related tasks such as provisioning, notifications, and record updates. The value is speed, but the control requirement is stronger: teams need logging, ownership, and lifecycle checks so automation does not spread inconsistency.
• Trust Decisioning: Trust decisioning is the process of deciding whether to allow, challenge, delay, or reject an interaction based on identity, behaviour, and context. In modern fraud control, it links verification, risk scoring, and authorisation into one governed decision path.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, IAM, and secrets management in the context of real-world identity risk. It helps practitioners connect control design to the access paths that phishing and other identity attacks exploit.