KnowBe4
Reports
All Statistics
The three most vulnerable industries at baseline are Healthcare & Pharmaceuticals (42.7%), Insurance (38.1%), and Retail & Wholesale (36%).
Organizations reduce phishing susceptibility by 79% after one year of consistent security awareness training.
Before any training, roughly one in three employees is likely to engage with a phishing attempt.
48% of surveyed organisations in the UK deploy autonomous AI agents capable of taking actions on their own
42% of cybersecurity leaders strongly believe that security awareness alone drives lasting behavior change
51% of leaders at UK organisations admit that AI usage within their perimeter is entirely unapproved or lacks formal corporate governance.
21% of UK employees say they don’t always use official corporate AI tools provided by their organisation
Across the UAE & KSA, 52% of cybersecurity decision- makers report that the unsanctioned use of external software and rogue AI applications has directly degraded or actively compromised their security posture over the past 12 months.
44% of the UAE & KSA employees confess that intense time constraints, cognitive overload, and everyday workplace distractions directly drive them to cut corners and make critical security errors, even when they are fully aware of safe protocols.
97% of cybersecurity leaders are using metrics to track human-related cybersecurity risks, yet only 61% say these fully support their efforts
41% of local workers in the UAE & KSA admit that if official corporate AI tools are restricted or too slow, they will actively source their own unapproved agentic AI tools to bypass administrative blocks.
58% of surveyed cybersecurity leaders say that everyday mistakes are a key driver of cybersecurity risks
60% of UK cybersecurity professionals say threats are already moving beyond email
66% of UK cybersecurity professionals believe employees are more likely to trust messages received through internal collaboration platforms
50% of UK organizations lack strong confidence in detecting threats across messaging and social platforms
Over a third of employees commonly source their own agentic AI tools when options are unavailable or restrictive.
42% of cybersecurity leaders identify AI-enabled attacks as a key driver of future human-related cybersecurity risks.
86% of employees say deepfake content is so realistic that it is harder to know what to trust.
In the last six months, Microsoft Teams attacks escalated by 41%.
Internal team impersonation was present in 30% of phishing attacks by threat actors in Q1 2026.
In the last six months, 86% of phishing attacks were AI-driven.
24% of Australians take no action after hearing about a major data breach unless directly notified.
66% of Australians reuse passwords across multiple online accounts.
53% of employed Australians prioritise protecting work accounts over personal accounts.
Email-related incidents increased by 57%.
97% of cybersecurity leaders feel the need for increased budget allocations to bolster the security of the human element.
Incidents relating to the human element surged by 90%.
In 2025, cybercriminals increased their abuse of legitimate platforms like QuickBooks, Zoom, SharePoint, and PayPal by 67% year-to-date.
Phone-based vishing attacks increased by 449% in 2025 compared to 2024, with phone numbers appearing as the sole payload in 5.5% of phishing emails.
In 2025, 77% of callback numbers used AI-generated voices, while 69% of vishing attacks were financially motivated, requesting bank detail changes, fraudulent refunds, or transfers.
65% of organisations plan to increase cybersecurity budgets.
32% of respondents believe that AI-based cybersecurity tools have the greatest impact.
Nearly 90% of respondents express confidence in their ability to respond to cyberattacks
Financial service firms globally experience up to 300 times more cyberattacks annually than other industries.
Initially, large financial institutions show 44.7% Phish-prone™ Percentage (PPP) rates, meaning nearly 45% of employees were susceptible to phishing attacks or likely to click on a malicious link or download an infected file.
Internal-themed topics accounted for 98.4% of the top 10 most-clicked email templates in the phishing simulations.
80.6% of the top 20 clicked links originated from internally-themed simulations.
HR-related themes were cited in 42.5% of phishing failures.
70% of surveyed state, local, tribal, and territorial (SLTT) organizations cite lack of sufficient funding as their top security concern
Security awareness training reduced phishing susceptibility from approximately 33.1% to just 4.1% after one year in state, local, tribal, and territorial (SLTT) governments.
Average ransom per attack on state, local, tribal, and territorial (SLTT) governments reached $872,656 between 2018 and December 2024, with total costs exceeding $1.09 billion.
Security training reduces global phishing click rates by 86%.
The global PPP fell by a total of 86% after 12 months of ongoing security training.
Globally, the top three most at-risk industries with the highest baseline PPP were Healthcare & Pharmaceuticals (41.9%), Insurance (39.2%), and Retail & Wholesale (36.5%).
68.6% of clicked links involved domain spoofing.
Over 60% of top-clicked phishing emails were related to HR and IT.
People were more likely to click on links related to internal topics or impersonating known brands, accounting for 61.6% of clicks.
Successful reported cyberattacks on UK utility companies surged by 586% from 2022 to 2023.
Security awareness training has significantly reduced phishing susceptibility in large energy organisations, dropping from 47.8% to 4% in one year.