Topic starter
01/08/2026 10:42 pm
TL;DR: A global pre-training Phish-prone Percentage of 33.2% is found in a 2026 benchmarking report, with continuous security awareness training reducing susceptibility by 87% to 4.2% over a year, according to Knowbe4. The governance lesson is that behavioural risk decays slowly, so identity and access programmes need sustained controls, not campaign-based awareness, and the report notes a 17.1% increase in phishing attacks since the second half of 2025.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “2026 KnowBe4 Phishing by Industry Benchmarking Report”.
By the numbers:
- The global average Phish-prone Percentage stands at 33.2% before any security awareness training.
- A full year of continuous security awareness training reduces Phish-prone Percentage by 87% to 4.2%.
Key questions
Q: Why does phishing susceptibility stay high even after awareness programmes start?
A: Because awareness decays when it is delivered as a one-off event instead of a continuous control.
Q: When should security teams prioritise continuous reinforcement over annual awareness training?
A: Whenever the organisation faces fast-changing phishing, impersonation or pretexting risk, continuous reinforcement should take priority.
Q: What are the signs that phishing awareness training is not working well enough?
A: Training is failing when employees still click, reply, or escalate suspicious messages without checking basic details first.
Practitioner guidance
- Establish continuous phishing training cycles Run recurring training and simulation rather than annual or ad hoc campaigns, and track whether susceptibility falls over months rather than after the first exercise.
- Measure phish-prone percentage by segment Break results out by industry, company size, and region so that high-risk groups can be targeted with different reinforcement cadences and scenario types.
- Tie training to identity workflow failures Focus scenarios on password resets, consent prompts, login pages, and approval requests, because those are the points where phishing becomes access.
Bottom line: Phishing remains a material identity risk because many users will still engage with malicious messaging before any training has taken effect.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:52 pm
Phishing resilience is now an identity control, not a comms programme. The report's numbers show that susceptibility is measurable, repeatable, and materially reducible only when training continues. That makes phishing defence part of identity governance because the outcome is access risk, not just user education completion. Practitioners should manage it with the same discipline used for access review and authentication policy.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How should security teams reduce phishing risk in cloud identity environments?
A: Security teams should prioritise phishing-resistant authentication for the access paths that can reach sensitive cloud services, privileged consoles, and third-party integrations. MFA alone is not enough if the control can be bypassed, socially engineered, or inconsistently enforced. Combine device-bound trust, strong account lifecycle governance, and explicit exception management so stolen credentials do not become an easy path into cloud data.
👉 Read our full editorial: Phishing susceptibility stays high until training becomes continuous