Pistachio conducted a year-long phishing simulation involving 2.47 million attacks sent to over 123,000 employees in more than 1,200 organizations. The analysis found that focusing solely on click rates in phishing tests can misrepresent actual risk, as credential submission and reporting are more indicative of phishing resilience. The study highlights significant variation in susceptibility across industries and teams, with financial services performing best and tech/IT employees showing unexpectedly high click and leak rates. The research also demonstrates that effective phishing resistance requires sustained training that encourages reporting suspicious emails and reduces credential leaks. The findings challenge conventional security awareness testing methods and advocate for measuring multiple user behaviors to better understand and improve organizational phishing resilience.

The impact of this research is primarily on how organizations assess and improve their phishing awareness programs. Relying only on click rates can create a false sense of security, as credential leaks pose a real risk of compromise. The study reveals that even technical teams, often assumed to be low risk, can be vulnerable. Organizations that do not measure credential leaks and reporting may underestimate their phishing risk and fail to implement effective mitigation strategies. The findings suggest that phishing risk profiles vary by industry and team, necessitating tailored training approaches. Sustained and behaviorally focused training can significantly improve phishing resilience by increasing reporting and reducing leaks over time.

This research advises organizations to expand phishing awareness testing metrics beyond click rates to include credential leak rates and reporting behaviors. Security teams should implement sustained, role-tailored phishing simulations and training programs that encourage employees to report suspicious emails rather than merely avoiding clicks. Continuous measurement of click, leak, and report behaviors over time is essential to accurately assess and improve phishing resilience. Organizations should avoid relying on a single phishing test and instead maintain ongoing training efforts to build vigilance and reduce credential leaks. No specific patches or technical fixes apply, as this is a behavioral and training-focused issue.