In the modern digital enterprise, the phishing simulation has become a staple of security awareness training. For years, Chief Information Security Officers (CISOs) have relied on a singular, headline metric to gauge the efficacy of their human firewalls: the click rate. However, a landmark study released by Oslo-based cybersecurity firm Pistachio suggests that this focus is not only incomplete—it may be dangerously misleading.
The report, which analyzed a massive dataset spanning from June 1, 2025, to May 31, 2026, challenges the industry to shift its perspective. By examining 2.47 million simulated phishing attempts across 123,000 employees in 1,200 organizations, Pistachio has provided a roadmap for redefining what it truly means to be a "phishing-resilient" organization.
The State of Human Risk: Key Findings and Data
The scale of the Pistachio research provides an unprecedented view into employee behavior across diverse sectors. The data reveals that the "tech-savvy" myth—the idea that employees in IT and development roles are naturally more resistant to social engineering—is fundamentally flawed.
Industry-Specific Vulnerabilities
Perhaps the most striking finding is the disparity between sectors. While financial services organizations consistently demonstrated the highest levels of resilience—outperforming other sectors in both click rates and the mitigation of credential leaking—the same could not be said for the technology sector.
Thirty percent of employees in tech development and IT roles clicked at least one phishing simulation during the study period. This high rate suggests that familiarity with technology does not equate to an inherent immunity to sophisticated, AI-driven social engineering. Conversely, the construction and real estate sectors emerged as high-risk areas, with nearly 20% of employees in those fields leaking sensitive credentials after a successful baiting attempt. Overall, the proportion of employees who clicked at least once ranged from 26% in design-focused roles to 41% in construction.
The Anatomy of the Data
Pistachio’s analysis focused on three distinct behaviors: clicking, leaking, and reporting. The research underscores that a "click" is merely the beginning of an attack lifecycle. A click alone represents a momentary lapse in judgment; the genuine catastrophe occurs when an employee proceeds to submit credentials or sensitive data.
The data highlights a concerning reality: even among groups that appear to be performing well, a small percentage of "high-risk" individuals can compromise an entire organization. Pistachio found that in a company of 500 employees, even if the majority are vigilant, approximately 1.57% will still leak credentials on their first encounter with a simulation. That equates to eight individuals who could provide an entry point for a catastrophic data breach.
Chronology of a Paradigm Shift: From Manual to Automated Training
The history of security awareness training has evolved from static, annual PowerPoint presentations to the dynamic, automated platforms seen today. Pistachio’s own evolution reflects this trajectory. Founded in 2019 in Oslo, Norway, the company has expanded its footprint to London and Valencia, focusing on the intersection of human risk management and AI.
The most profound shift in this landscape is the application of Artificial Intelligence to simulate the "human element." During the 12-month study period, Pistachio utilized an AI-driven platform to deploy simulated attacks via email and Microsoft Teams. The complexity and content of these simulations were not static; they were tailored to the recipient’s specific role and their historical responses to previous tests.
The efficiency gains are staggering. Pistachio estimates that had this level of personalized, adaptive testing been performed manually, it would have taken 23 years to reach the scale achieved in just 12 months. This acceleration allows security teams to move from "snapshot" testing to a continuous state of evaluation, providing a far more accurate representation of how an organization reacts to evolving threats.
Official Perspectives: The CISO’s Dilemma
Joe Jones, CEO and co-founder of Pistachio, emphasizes that the industry’s obsession with the "click rate" is a vanity metric that creates a false sense of security.
"A low click rate can create a false sense of security," Jones explains. "Clicking a phishing link is just one moment in a longer chain of employee behavior, and on its own, it says little about whether the organization is actually getting more resilient. What matters more is what happens next: does the employee hand over credentials, recognize the attack and stop, or report it so the wider business can act?"
According to the report, the true indicator of a mature security culture is not just the absence of clicks, but the presence of reporting. By the end of the 12-month program, users in the study reported suspicious emails nearly twice as often as they clicked them. This "reporting-first" mentality is the hallmark of a healthy security posture.
Implications for Future Phishing Simulations
The Pistachio report serves as a wake-up call for organizations relying on legacy, "set-it-and-forget-it" phishing simulations. To build genuine resilience, companies must implement several structural changes to their training programs.
1. Sustained Engagement is Non-Negotiable
The data reveals a counter-intuitive trend: click and leak rates often rise during the first six months of a new training program. This is not necessarily a sign of failure, but rather a reflection of increased testing sophistication and the removal of "security theater." It takes time for employees to develop the muscle memory required to identify sophisticated threats. Training must be a sustained, year-round effort rather than an intermittent event.
2. Redefining Success Metrics
Organizations must move away from judging phishing programs solely by click rates. Future metrics should look at a "behavioral composite score":
- The Reporting Ratio: How many users report an email vs. how many click it.
- The Containment Rate: The speed and frequency with which employees stop a potential compromise before credentials are leaked.
- The Residual Risk: Identifying the specific percentage of the workforce that remains high-risk despite training.
3. Addressing the Geographic Gap
While the Pistachio study is comprehensive, it highlights a missing piece in the global cybersecurity discourse: geographic analysis. Despite the massive scale of the data, the report lacks a breakdown by region. As multinational organizations continue to navigate varied regulatory environments and cultural differences in digital literacy, the absence of geographic insights leaves a gap in the security strategy. It remains to be seen whether employees in different global regions demonstrate varying levels of phishing susceptibility, a variable that could significantly inform how localized training programs are designed.
4. Beyond the Technical Silo
The high click rates among IT and tech development staff prove that technical knowledge is not a surrogate for security awareness. Organizations must stop exempting "technical" teams from mandatory phishing training. If anything, these teams are prime targets for sophisticated attackers, as a successful compromise of a developer’s credentials could provide access to source code or administrative systems.
Conclusion: The Path Forward
The message from the 2026 Phishing Behaviour Report is clear: phishing resilience is a journey, not a destination. Organizations that treat phishing simulations as a "check-the-box" compliance requirement will continue to be vulnerable to the evolving tactics of cybercriminals.
By moving beyond the click and focusing on the full lifecycle of an employee’s response—from initial interaction to the critical act of reporting—companies can turn their workforce from a liability into an asset. As AI continues to lower the barrier to entry for attackers, the human element remains the last, and most important, line of defense. The findings from Pistachio serve as a necessary blueprint for any organization looking to harden that defense in an increasingly dangerous digital landscape.
