KnowBe4
Reports
All Statistics
93% of cybersecurity leaders reported incidents caused by cybercriminals exploiting employees.
Email-related incidents increased by 57%.
90% of organizations experienced incidents caused by employee mistakes.
97% of cybersecurity leaders feel the need for increased budget allocations to bolster the security of the human element.
Incidents relating to the human element surged by 90%.
AI applications experienced a 43% increase in security incidents over the past 12 months, marking the second-largest increase across all channels.
45% of cybersecurity leaders cited constantly evolving AI threats as their greatest challenge when tackling behavioral risk.
64% of organizations fell victim to external attacks that exploited employees through email.
Malicious insiders accounted for incidents at 36% of organizations.
56% of employees are unhappy with their company's approach to AI tools, which can drive them toward unsanctioned platforms and creating 'shadow AI' risks.
32% of organizations reported increased incidents related to deepfakes.
In 2025, cybercriminals increased their abuse of legitimate platforms like QuickBooks, Zoom, SharePoint, and PayPal by 67% year-to-date.
In 2025, 77% of callback numbers used AI-generated voices, while 69% of vishing attacks were financially motivated, requesting bank detail changes, fraudulent refunds, or transfers.
Phone-based vishing attacks increased by 449% in 2025 compared to 2024, with phone numbers appearing as the sole payload in 5.5% of phishing emails.
65% of organisations plan to increase cybersecurity budgets.
32% of respondents believe that AI-based cybersecurity tools have the greatest impact.
Nearly 90% of respondents express confidence in their ability to respond to cyberattacks
43% of cybersecurity professionals identified distraction as a primary reason employees fall victim to cyberattacks.
26% of respondents indicated that AI-based cybersecurity tools are prioritised for funding.
74% of respondents stated that phishing is the leading threat, with impersonation of executives or trusted colleagues being the most common tactic.
60% of organisations fear the rise of AI-generated threats.
41% of cybersecurity professionals identified lack of security awareness training as a primary reason employees fall victim to cyberattacks.
74% of respondents stated that phishing is the leading threat, with impersonation of executives or trusted colleagues being the most common tactic.
Financial service firms globally experience up to 300 times more cyberattacks annually than other industries.
100% of Europe's top financial firms suffered supplier breaches.
A single day's disruption in payments by major banks could affect 38% of network banks globally
Almost all (97%) of major U.S. banks experienced third-party breaches in 2024.
Targeted intrusions against financial institutions increased by 109% year-over-year.
Comprehensive security awareness training can reduce phishing susceptibility to below 5%.
There has been a 25% year-on-year increase in financial institution intrusion events for 2024.
Infostealer infection attempts increased 58% in 2024.
Analysis of over three million dark web posts shows stolen credentials far outpace credit card theft.
Initially, large financial institutions show 44.7% Phish-prone™ Percentage (PPP) rates, meaning nearly 45% of employees were susceptible to phishing attacks or likely to click on a malicious link or download an infected file.
The U.S. accounts for 60% of all ransomware attacks against financial institutions.
The U.S. and U.K. together represent over 70% of ransomware attacks.
80.6% of the top 20 clicked links originated from internally-themed simulations.
HR-related themes were cited in 42.5% of phishing failures.
71.9% of interactions with malicious landing pages involved branded content.
80.6% of the top 20 clicked links originated from internally-themed simulations.
PDF attachment clicks in phishing simulations increased by 8.1% compared to Q1 2025.
Among internally-themed links, 68.2% utilised domain spoofing techniques.
Internal-themed topics accounted for 98.4% of the top 10 most-clicked email templates in the phishing simulations.
Internal-themed topics accounted for 98.4% of the top 10 most-clicked email templates in the phishing simulations.
PDFs comprised the majority, 61.1%, of the top 20 attachments clicked in phishing simulations.
PDF attachment clicks in phishing simulations increased by 8.1% compared to Q1 2025.
71.9% of interactions with malicious landing pages involved branded content.
IT-related themes were cited in 21.5% of phishing failures.
Average ransom per attack on state, local, tribal, and territorial (SLTT) governments reached $872,656 between 2018 and December 2024, with total costs exceeding $1.09 billion.
70% of surveyed state, local, tribal, and territorial (SLTT) organizations cite lack of sufficient funding as their top security concern