Phishing Simulation Study Finds Click Rates Alone Can Misstate Employee Risk
Summary
Pistachio analyzed 2.47 million simulated phishing attempts across more than 123,000 employees. Its findings suggest click rates alone can misrepresent phishing resilience; credential leaks and reporting behavior also matter.
Key points
- The study covered 2.47 million simulated phishing attempts sent to more than 123,000 employees at over 1,200 organizations from June 2025 to May 2026.
- At least one simulation was clicked by 30.27% of tech development employees and 28.53% of IT employees.
- Click rates varied by sector, from 26.35% in Design to 41.31% in Construction; nearly 20% of construction and real estate employees leaked credentials after a successful phishing attempt.
- On their first simulation, more users reported than clicked, but 1.57% still leaked credentials.
- By the end of the 12-month program, employees reported suspicious emails nearly twice as often as they clicked them.
- Click and credential-leak rates rose during the program’s first six months before beginning to decline, suggesting training needs to be sustained.
- The article notes the study did not analyze results by geographic location.
Article Details
- Publisher
- Pistachio
- Report Period
- 2025-06-01 to 2026-05-31
- Scope
- Simulated phishing attempts and employee click, credential-leaking, and reporting behavior across organizations and industry sectors.
- Sample Size
- 2.47 million simulated phishing attempts sent to more than 123,000 employees in more than 1,200 organizations.
- Key Statistics
- 30% of tech development and IT employees clicked at least one simulation.
- Nearly 20% of construction and real estate employees leaked credentials after a successful simulated phishing attempt.
- First-simulation credential leakage was 1.57%; the report estimates that about 8 employees in a 500-person company would disclose login details.
- Click rates ranged from 26.35% in Design to 41.31% in Construction.
- By the end of the 12-month program, users reported suspicious emails nearly twice as often as they clicked them.
- Recommendations
- Evaluate phishing simulations using click, credential-leak, and reporting behaviors together rather than click rate alone.
- Sustain phishing-awareness training over time; the report says click and leak rates rose during the first six months before beginning to decline.
People
Industries
ConstructionNearly 20% of construction and real estate employees leaked credentials after a successful phishing attempt.DesignThe proportion of employees who clicked at least once ranged from 26% in Design to 41% in Construction.Financial ServicesFinancial services were the most resilient, outperforming all other sectors in click, credential leaking and reporting rates.ITIt specializes in automated human risk management, employee security awareness training, and phishing simulations.real estateNearly 20% of construction and real estate employees leaked credentials after a successful phishing attempt.