KnowBe4, the global leader in digital workforce security, securing both AI agents and humans, today released its 2026 Phishing by Industry Benchmarking Report, revealing that organizations can reduce phishing susceptibility by 79% after one year of consistent security awareness training (SAT), despite a threat landscape increasingly powered by artificial intelligence. The report analyzed 42 million phishing simulations across 14.8 million users at 64,000 organizations worldwide.
Global average Phish-prone Percentage starts at 33.2% before training.
After 90 days, drops to 20.1%; after one year, falls to 4.2%.
79% reduction in phishing susceptibility after one year of training.
17.1% spike in phishing attacks since late 2025.
Most vulnerable industries: Healthcare & Pharmaceuticals (42.7%), Insurance (38.1%), Retail & Wholesale (36%).
Africa highest baseline risk (35.9%); Asia lowest (24.9%).
Before any training, roughly one in three employees is likely to engage with a phishing attempt. Baseline PPP rises steadily with organizational size, with large enterprises of 10,000+ employees facing 39.5% compared to 24.7% for small businesses. For the second consecutive year, the three most vulnerable industries at baseline are Healthcare & Pharmaceuticals (42.7%), Insurance (38.1%), and Retail & Wholesale (36%). Organizations reduced phishing susceptibility by 40% within the first 90 days and by 79% after one year of ongoing security awareness training. Across regions, Africa recorded the highest baseline risk at 35.9%, followed by North America at 34.5%, while Asia entered with the lowest baseline at 24.9%.
Javvad Malik, lead CISO advisor at KnowBe4, stated: "As organizations expand their workforce from humans to include autonomous AI agents, the attack surface grows in ways traditional controls were not designed to address. This complexity is being exploited, evidenced by a 17% spike in phishing attacks since late 2025 alone. However, the data proves organizations can combat this through continuous personalized training, which drops employee phishing susceptibility to 4.2% over 12 months."
These findings come at a crucial point as cybercriminals increasingly leverage AI to generate highly personalized phishing campaigns, business email compromise (BEC) schemes, and deepfake-enabled social engineering attacks at scale. The report highlights that while employees remain a primary target for cybercriminals, organizations that invest in ongoing training and simulated phishing exercises can dramatically reduce employee phishing susceptibility over time.
About KnowBe4
KnowBe4 empowers the modern workforce to make smarter security decisions every day. Trusted by more than 70,000 organizations worldwide, KnowBe4 is the pioneer of digital workforce security, securing both AI agents and humans. The KnowBe4 Platform provides attack simulation and training, collaboration security, and agent security powered by AIDA (Artificial Intelligence Defense Agents) and a proprietary Risk Score. The platform leverages 15-years of behavioral data to combat advanced threats including social engineering, prompt injection, and shadow AI.
TechIntelPro empowers B2B technology decision-makers with the latest industry trends, deep insights, leadership perspectives and actionable intelligence to drive both organizational and professional milestones, and thrive on the tech pulse.
