Report by KnowBe4
Phishing by Industry Benchmarking Report: 2026 Edition
Key Findings
Organizations reduce phishing susceptibility by 79% after one year of consistent security awareness training.
Before any training, roughly one in three employees is likely to engage with a phishing attempt.
Africa records the highest baseline Phish-prone Percentage at 35.9%, followed by North America at 34.5%, South America at 31.5%, and Asia at 24.9%.
Global average Phish-prone Percentage (PPP) starts at 33.2% before training, drops to 20.1% after 90 days of security awareness training, and falls to 4.2% after one year.
Organizations reduce phishing susceptibility by 40% within the first 90 days of ongoing security awareness training.
Large enterprises with 10,000+ employees face a baseline Phish-prone Percentage of 39.5%, compared to 24.7% for small businesses.
The three most vulnerable industries at baseline are Healthcare & Pharmaceuticals (42.7%), Insurance (38.1%), and Retail & Wholesale (36%).
After 90 days of security awareness training, the global average PPP drops to 20.1%.
The three industries with the highest baseline PPP are Healthcare & Pharmaceuticals at 42.7%, Insurance at 38.1%, and Retail & Wholesale at 36%.
Baseline PPP by region is: Africa 35.9%, North America 34.5%, South America 31.5%, and Asia 24.9%.
The global average Phish-prone Percentage (PPP) is 33.2% before training.
After one year of security awareness training, the global average PPP falls to 4.2%.
Organizations reduce phishing susceptibility by 40% within the first 90 days of training and by 79% after one year of ongoing security awareness training.
Large enterprises with 10,000+ employees have a baseline PPP of 39.5%, compared to 24.7% for small businesses.