Topic starter
02/08/2026 12:08 pm
TL;DR: South America starts with a 39.1% phishing-prone percentage, the highest in the world, according to Knowbe4 research, but that falls to 18.2% after 90 days of training and 4.5% after a year, while AI-generated phishing now accounts for 82.6% of emails. The finding is clear: awareness programmes remain one of the few controls that can materially reduce human-driven exposure at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Relatório: Relatório de benchmark de phishing por setor de 2025 para a América do Sul”.
By the numbers:
- AI-generated content now appears in 82.6% of phishing emails, according to Knowbe4.
Key questions
Q: What reduces phishing risk when awareness scores are already high?
A: Risk falls when awareness is continuous, measured, and tied to real user behaviour rather than completion rates.
Q: Why do non-email phishing campaigns increase enterprise risk?
A: They increase risk because they bypass the controls most organisations built around email, while still targeting the same identities and the same SSO-connected applications.
Q: What are the signs that phishing awareness training is not working well enough?
A: Training is failing when employees still click, reply, or escalate suspicious messages without checking basic details first.
Practitioner guidance
- Adopt continuous phishing simulation Run recurring simulations that measure click, report, and credential-submission behaviour over time, then segment results by region, function, and business unit.
- Tie awareness to identity risk metrics Use phishing susceptibility as an input to identity governance and access review prioritisation, especially where user compromise would expose privileged or sensitive workflows.
- Harden high-risk approval paths Add step-up verification for payment changes, account recovery, delegated approvals, and external login events so a phished user cannot easily authorise sensitive actions.
Bottom line: Phishing benchmarks are strongest when they measure behaviour over time, because click susceptibility can fall sharply with sustained training.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:13 pm
Phishing is now an identity control problem, not just an email problem. The report shows that the most effective reduction in risk comes from changing user behaviour over time, which means the governance boundary sits squarely inside identity programmes. Awareness is not a soft control here, because a single click can translate into valid authentication, delegated access, or fraudulent approval. Practitioners should treat phishing resilience as part of identity assurance, not a standalone awareness metric.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: Should organisations prioritise awareness training or stronger email controls first?
A: They should do both, but prioritisation depends on the failure mode. If messages are getting through at scale, email controls need attention first. If users still engage with tested lures despite filtering, sustained awareness becomes the better investment. Mature programmes combine both because phishing succeeds when technical and human defences are treated as separate problems.
👉 Read our full editorial: Phishing benchmarks show awareness training sharply reduces risk