Phishing Resilience Requires More Than Click Rates, Pistachio Report Finds
Summary
Pistachio’s 2026 report analyzes phishing simulations across 648 organizations and finds resilience is better measured through clicks, credential submission, and reporting. Results varied over time and by department.
Key points
- The report analyzed 354,962 simulations across 648 organizations and 123,692 users from June 2025 to May 2026.
- It recommends assessing clicks, credential submission, and reporting together rather than relying on click rates alone.
- Clicking and credential submission rose through the six-month stage, then declined; the report cautions that these stages compare overlapping, non-identical groups.
- From the six-month peak to the 12-month stage, clicks declined 27%, credential leaks 41%, and reports 19%; the report-to-click ratio rose to 1.8.
- Construction had the highest departmental cumulative click rate (41.31%) and credential leak rate (16.47%); Health had the lowest reporting rate (13.17%).
- Department-level differences support tailoring training to whether employees struggle to recognize phishing, report it, or avoid submitting credentials.
- The report says easy reporting can help employees alert security teams, enabling investigation and removal of similar messages from other inboxes.
Article Details
- Publisher
- Help Net Security
- Report Period
- 2025-06-01 to 2026-05-31
- Scope
- Pistachio’s Phishing Behaviour Report 2026; phishing simulation results across organizations and departments
- Sample Size
- 648 organizations with complete 12-month records and 123,692 users; journey analysis covered 354,962 simulations
- Key Statistics
- Across the journey analysis, click and credential-submission rates increased through the first six months and declined at later stages; the stages compared overlapping but non-identical groups.
- At six months, users received an average of 3.5 simulations per person, compared with 2.6 at three months and 2.8 at 12 months; 50.4% of simulations at six months were classified as Hard.
- From the six-month peak to the 12-month stage, clicks declined by 27%, credential leaks by 41%, and reports by 19%.
- The report-to-click ratio increased from 1.3 at three months to 1.8 at 12 months.
- Construction had the highest departmental cumulative click rate (41.31%) and leak rate (16.47%); Health had the lowest report rate (13.17%) among named departments.
- Recommendations
- Measure phishing resilience using clicks, credential submission, and reporting together rather than click rates alone.
- Make threat reporting easy, for example through one-click reporting, and provide timely confirmation.
- Use department-level results to target training to the behaviors and risks each team exhibits.
- Interpret declining click rates in light of simulation difficulty and avoid relying on repeated, familiar templates.
People
Industries
ConstructionThe report also shows that performance can change over time and vary widely by department, with construction, health, logistics, and IT all showing different risk patterns.Facility ManagementConstruction and Facility Management showed the greatest exposure to clicking and credential submission.HealthThe report also shows that performance can change over time and vary widely by department, with construction, health, logistics, and IT all showing different risk patterns.logisticsThe report also shows that performance can change over time and vary widely by department, with construction, health, logistics, and IT all showing different risk patterns.