Topic starter
02/08/2026 12:08 pm
TL;DR: South America starts at a 39.1% phishing-prone percentage, and Knowbe4 reports it falls to 18.2% after 90 days of training and 4.5% after a year. Phishing resilience needs sustained measurement because authentication and approval paths still depend on how people respond under pressure.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Relatório: Relatório de benchmark de phishing por setor de 2025 para a América do Sul”.
By the numbers:
- AI-generated content now appears in 82.6% of phishing emails, according to Knowbe4.
Key questions
Q: Why do non-email phishing campaigns increase enterprise risk?
A: They increase risk because they bypass the controls most organisations built around email, while still targeting the same identities and the same SSO-connected applications.
Q: What are the signs that phishing awareness training is not working well enough?
A: Training is failing when employees still click, reply, or escalate suspicious messages without checking basic details first.
Q: What reduces phishing risk when awareness scores are already high?
A: Risk falls when awareness is continuous, measured, and tied to real user behaviour rather than completion rates.
Practitioner guidance
- Adopt continuous phishing simulation Run recurring simulations that measure click, report, and credential-submission behaviour over time, then segment results by region, function, and business unit.
- Tie awareness to identity risk metrics Use phishing susceptibility as an input to identity governance and access review prioritisation, especially where user compromise would expose privileged or sensitive workflows.
- Harden high-risk approval paths Add step-up verification for payment changes, account recovery, delegated approvals, and external login events so a phished user cannot easily authorise sensitive actions.
Bottom line: Phishing benchmarks are strongest when they measure behaviour over time, because click susceptibility can fall sharply with sustained training.
Glossary terms: Phish-prone percentage, Security Awareness Training, AI-generated phishing, Human Trust Decay Gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:13 pm
Phishing is now an identity control problem, not just an email problem. The report shows that the most effective reduction in risk comes from changing user behaviour over time, which means the governance boundary sits squarely inside identity programmes. Awareness is not a soft control here, because a single click can translate into valid authentication, delegated access, or fraudulent approval. Practitioners should treat phishing resilience as part of identity assurance, not a standalone awareness metric.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: Should organisations prioritise awareness training or stronger email controls first?
A: They should do both, but prioritisation depends on the failure mode. If messages are getting through at scale, email controls need attention first. If users still engage with tested lures despite filtering, sustained awareness becomes the better investment. Mature programmes combine both because phishing succeeds when technical and human defences are treated as separate problems.
👉 Read our full editorial: Phishing benchmarks show awareness training sharply reduces risk