2026 KnowBe4 Phishing by Industry Benchmarking Report

Every year, KnowBe4 analyzes millions of simulated phishing tests to answer one question: how vulnerable is your workforce, and what does it actually take to change that? The 2026 Phishing by Industry Benchmarking Report delivers the answer with hard data — covering 19 industries, four organization sizes, and seven global regions.

Before any security awareness training, the global average phish-prone percentage (PPP) stands at 33.2%. That means one in three employees are likely to engage with a malicious email before your organization has done anything to stop them.

The good news: training works. Organizations that commit to a full year of continuous security awareness training reduce their PPP by an average of 87%, bringing average susceptibility down to just 4.2%. The data also shows that the biggest gains don't come in the first 90 days — they come between month three and month 12, making the case for sustained programs over one-off campaigns.

Key findings include:

• Healthcare & Pharmaceuticals, Insurance, and Retail & Wholesale are the highest-risk industries for the second consecutive year
• Organizational size directly amplifies risk — enterprises with 10,000+ employees start nearly 15 percentage points more susceptible than small businesses
• South America achieved the lowest one-year regional PPP globally at 3.3%; Africa carries the highest residual risk at 7.4%
• AI-powered phishing is reshaping the threat landscape, demanding more personalized, continuous training approaches

Download the report to get:

• Baseline, 90-day, and 1-year PPP benchmarks broken down by industry and organization size
• Regional threat analysis from KnowBe4 CISO advisors across Africa, Asia, Australia & New Zealand, Europe, North America, South America, and the UK & Ireland
• Actionable guidance on building a security awareness program and how to leverage AI to deliver personalized, targeted training that changes behavior and reduces risk