AnalysisPublished 11 Sep 2026

Phishing Research Challenges Conventional Security Awareness Testing

Source SecurityWeek

phishing

Description

A large-scale phishing simulation study involving 2.47 million simulated attacks across 1,200 organizations reveals that measuring only click rates in phishing awareness tests is insufficient. The research shows that credential leaks and reporting behaviors are critical metrics for assessing true phishing resilience. Different industries and teams exhibit varying susceptibility, with tech and IT employees surprisingly vulnerable. Sustained training programs improve reporting rates and reduce leaks over time, but initial click and leak rates may increase before declining. The study emphasizes the need for nuanced phishing risk profiles and continuous, behavior-focused training beyond simple click metrics.

Impact

The impact of this research is primarily on how organizations assess and improve their phishing awareness programs. Relying only on click rates can create a false sense of security, as credential leaks pose a real risk of compromise. The study reveals that even technical teams, often assumed to be low risk, can be vulnerable. Organizations that do not measure credential leaks and reporting may underestimate their phishing risk and fail to implement effective mitigation strategies. The findings suggest that phishing risk profiles vary by industry and team, necessitating tailored training approaches. Sustained and behaviorally focused training can significantly improve phishing resilience by increasing reporting and reducing leaks over time.

Defensive guidance

This research advises organizations to expand phishing awareness testing metrics beyond click rates to include credential leak rates and reporting behaviors. Security teams should implement sustained, role-tailored phishing simulations and training programs that encourage employees to report suspicious emails rather than merely avoiding clicks. Continuous measurement of click, leak, and report behaviors over time is essential to accurately assess and improve phishing resilience. Organizations should avoid relying on a single phishing test and instead maintain ongoing training efforts to build vigilance and reduce credential leaks. No specific patches or technical fixes apply, as this is a behavioral and training-focused issue.

Summary

Pistachio conducted a year-long phishing simulation involving 2.47 million attacks sent to over 123,000 employees in more than 1,200 organizations. The analysis found that focusing solely on click rates in phishing tests can misrepresent actual risk, as credential submission and reporting are more indicative of phishing resilience. The study highlights significant variation in susceptibility across industries and teams, with financial services performing best and tech/IT employees showing unexpectedly high click and leak rates. The research also demonstrates that effective phishing resistance requires sustained training that encourages reporting suspicious emails and reduces credential leaks. The findings challenge conventional security awareness testing methods and advocate for measuring multiple user behaviors to better understand and improve organizational phishing resilience.

References

securityweek.com/phishing-research-challenges-conventional-security-awareness-testing/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Sep 2026, 17:32 UTC

References

Community reviews

Related threats