Security Awareness and Human Risk Statistics Guide: What the Data Shows

People are involved in most breaches, but the statistics used to justify awareness programmes range from rigorous breach analysis to vendor surveys of the vendor's own customers, and they are often quoted as if they were the same thing. This page brings together the most cited recent figures on the human element in breaches, awareness training coverage, phishing simulation results, risky user concentration and employee use of AI tools, each with its publisher, report and period. Primary sources are the Verizon 2026 Data Breach Investigations Report (DBIR), the UK government Cyber Security Breaches Survey 2025/2026, the KnowBe4 2025 Phishing by Industry Benchmarking Report, the SANS 2025 Security Awareness Report and the Mimecast State of Human Risk 2025 report. It is for awareness leads, CISOs and risk owners building a programme case or setting targets. Programme design is covered in the Security Awareness and Human Risk Management Guide; phishing volumes are in the Phishing Statistics Guide. Last reviewed: November 2026.

Key takeaways

• The human element is in most breaches. Verizon's 2026 DBIR found the human element in 62% of breaches, against 60% a year earlier, a change Verizon says is within its error margins.
• Most small organisations still do not train staff. The UK Cyber Security Breaches Survey 2025/2026 found only 19% of businesses ran staff training or awareness-raising in the previous year, rising to 84% of large businesses.
• Training moves simulation results, in vendor data. KnowBe4 reports an industry baseline phish-prone percentage of 33.1% falling to 4.1% after 12 months of training and testing, an 86% reduction across its customer base.
• Mobile lures beat email lures. The 2026 DBIR puts the median email simulation click rate at 1.4% and phone-centric (voice and text) simulations closer to 2%, about 40% higher.
• Human risk now includes AI use. Verizon found 45% of employees were regular AI users on corporate devices, up from 15% a year earlier, and 67% of users accessed AI services with non-corporate accounts.

How to read human risk statistics

• Breach data versus survey data: the DBIR counts what happened in confirmed breaches; the UK survey measures what organisations say they do; vendor surveys measure opinion. Only the first supports a claim about cause.
• Customer-base bias: KnowBe4 and Mimecast figures describe organisations that already buy awareness or email security products. Improvement curves from those customers are evidence the approach can work, not an industry average.
• Definitions move: the DBIR "human element" covers social engineering, errors and misuse together. It is not a measure of training failure.

The human element in breaches

• What changed: vulnerability exploitation (31%) overtook stolen credentials as the top initial access route in the 2026 DBIR, the first time in the report's 19 editions. People remain involved in most breaches, but the entry point has shifted towards technical exposure.
• Pretexting and help desks: pretexting is the con behind help desk resets and fake supplier requests. The Marks and Spencer Cyberattack 2025 and Caesars Entertainment Breach 2023 both turned on social engineering of support or third-party staff.
• Errors are falling as a share: the cover charts show Miscellaneous Errors shrinking from a quarter of breaches in 2024 to 8%. That is a share, so it can fall because other patterns grew.

Awareness training and testing coverage

The UK Cyber Security Breaches Survey is the most robust public measure of what organisations actually do, because it uses a random sample and is published as Official Statistics.

• The size gap is the story: nearly all large businesses train staff, but four in five businesses overall do not. Averages hide that most small firms have no programme at all.
• Phishing dominates disruption: among UK organisations hit, phishing was the most disruptive breach type for 69%, and for 51% of affected businesses it was the only type experienced.
• Frequency among larger buyers: 87% of decision-makers in Mimecast's survey said their organisation trains employees to spot attacks at least once a quarter. That figure reflects a population of security buyers, not all organisations.

Phishing simulation results

• Two very different baselines: KnowBe4's 33.1% is an untrained baseline on deliberately hard tests; Verizon's 1.4% is a median across its simulation partners' campaigns. Neither is wrong. They measure different populations and test difficulty.
• Click rate is a weak outcome measure: simulation difficulty drives click rates, so a falling rate can mean easier lures. Reporting rate and time to report say more about whether people act as sensors.
• Extend beyond email: the DBIR mobile figures support including SMS and voice scenarios, and help desk verification, in the programme. See the Vishing and Help Desk Social Engineering Awareness Guide.

Risky user concentration, programme resourcing and AI use

• Concentration supports targeting: if a small group drives most incidents, adaptive training and extra controls for that group beat equal annual modules for everyone. The 8% figure is a single vendor's statement; validate it against your own incident and simulation data.
• Staffing is the constraint: SANS findings suggest a part-time awareness owner cannot move behaviour. Budget cases should cost people, not just content licences.
• Shadow AI is a human risk: the DBIR found shadow AI was the third most common non-malicious insider action in its data loss prevention dataset. See the Shadow AI Statistics page.

Choosing the right figure for the audience

The same programme needs different evidence for different readers. Picking the figure whose population and method match the question avoids challenge from a sceptical board member or auditor.

• State the limitation in the same sentence: for example, "KnowBe4 reports an 86% reduction across its customers after 12 months of training and testing." Naming the population pre-empts the obvious objection.
• Pair one external figure with one internal one: a benchmark explains why a risk matters; your own reporting rate or repeat clicker rate shows whether the programme is working.
• Small and large organisations need different benchmarks: a small firm comparing itself with the 84% large-business training rate will overstate its gap with peers of its own size.

Where identity fits

Most human-element breaches end with an identity being misused: a password typed into a fake page, an MFA prompt approved, a help desk reset granted to a caller, or a token pasted into an AI tool. Awareness reduces how often that happens; identity controls reduce what it costs when it does. Phishing-resistant authentication removes the payoff from credential phishing (see the Phishing-Resistant MFA Guide), and identity verification for resets removes the payoff from pretexting. Employees also handle non-human credentials: API keys and tokens shared in chat or pasted into AI assistants are human errors with machine-identity consequences.

What the numbers mean for defenders

Internal measures that turn these benchmarks into evidence for your own organisation:

1. Reporting rate of simulated and real phishing, and median time from delivery to first report.
2. Repeat clicker rate: share of users who fail more than one simulation in 12 months.
3. Training coverage by role, including contractors and help desk staff.
4. Human-initiated incidents per quarter, by type (phishing, error, misuse, AI data leakage).
5. Help desk verification failures caught by procedure rather than by luck.

Common mistakes when using human risk statistics

• Citing "human error causes most breaches": the DBIR human element includes social engineering by criminals. It does not say employees are careless in 62% of breaches.
• Treating vendor improvement curves as guaranteed: an 86% reduction in a vendor's customer base is a best case among active users of that product.
• Comparing click rates across tools: test difficulty and templates differ; compare your own rate over time with consistent difficulty.
• Quoting old DBIR editions: earlier editions gave different shares (60% in the 2025 report). Name the edition.
• Ignoring organisation size: a 19% training rate and an 84% rate for large firms come from the same survey. Use the band that matches your audience.

Practitioner checklist

• Cite each figure with publisher, edition and population, and label vendor surveys as such.
• Baseline your own reporting rate, repeat clicker rate and training coverage before the next budget cycle.
• Include SMS, voice and help desk scenarios in simulations, not only email.
• Give support, finance and admin staff role-based training on pretexting and reset verification.
• Identify high-risk user groups from incident and simulation data and apply extra controls.
• Publish AI acceptable use rules and cover them in training, including handling of keys and tokens.
• Pair awareness with phishing-resistant MFA so a single mistake does not become a breach.
• Re-check the DBIR and UK survey each spring before reusing these numbers.

Standards and references

• Verizon: 2026 Data Breach Investigations Report
• UK Department for Science, Innovation and Technology: Cyber Security Breaches Survey 2025/2026
• KnowBe4: 2025 Phishing by Industry Benchmarking Report
• SANS: 2025 Security Awareness Report announcement
• Mimecast: State of Human Risk 2025
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• MITRE ATT&CK: Phishing

Related NHI Mgmt Group resources: Security Awareness and Human Risk Management Guide · Phishing Statistics Guide · CIS Control 14 Security Awareness and Skills Training Guide · Insider Threat Statistics Guide