Study shows less vulnerability to phishing after training

The vulnerability to phishing in Europe drops by 83 percent after one year of security training, according to the major new study, "Phishing by Industry Benchmarking Report 2026." The study also reveals that healthcare, pharmaceuticals, insurance, and retail/wholesale are the most vulnerable sectors.

The Phishing by Industry Benchmarking Report 2026 states that European companies can reduce their employees' vulnerability to phishing by 83 percent if they consistently raise their employees' security awareness (SAT) for one year. This is possible despite a threat landscape increasingly shaped by artificial intelligence.

Training courses have been proven to raise awareness of vulnerability to phishing.

The report analyzed 42 million phishing simulations across 14,8 million users in 64.000 companies worldwide. The findings show that while employees remain a primary target for cybercriminals, companies can drastically reduce their employees' vulnerability to phishing over time by investing in ongoing training and simulated phishing exercises.

According to the report, the European average for the "phish-prone percentage" (PPP), i.e., the percentage of employees likely to fall victim to a phishing attack, is 31,1 percent before training. After 90 days of security training, this figure drops to 21,4 percent, and after one year to just 5,4 percent. This corresponds to a relative risk reduction of 83 percent compared to the baseline.

Cybercriminals are increasingly relying on AI as an aid.

These findings are crucial, as cybercriminals are increasingly using AI to generate highly personalized phishing campaigns, business email compromise (BEC) attacks, and deepfake-powered social engineering attacks at scale. It is therefore more important than ever to ensure that employees are aware of the latest cyber threats to avoid becoming victims of such attacks. The most important results are:

Before a training course Approximately one in three employees (31,1 percent) in Europe is likely to react to a phishing attempt. This is an improvement of 1,4 percentage points compared to 2025. The figure is below the global benchmark of 33,2 percent.

The underlying asset The vulnerability to phishing attacks (PPP) increases steadily with company size. Large companies in Europe with more than 10.000 employees have a baseline value of 38,1 percent, compared to 23,5 percent for small companies.

For the second time Consequently, the three most vulnerable sectors are healthcare and pharmaceuticals (baseline: 42,7 percent), insurance (baseline: 38,1 percent), and retail and wholesale trade (baseline: 36 percent). The European pattern is consistent with the global one, although it should be noted that some European sector samples are small and therefore only indicative.

healthcare companies The pharmaceutical industry in Europe recorded a baseline value of 33,4 percent, which is above the regional average. The banking sector reported the highest baseline value among the larger European industry samples, at 40,8 percent.

Companies in Europe They reduced their vulnerability to phishing by 31 percent within the first 90 days and by 83 percent after a year of continuous security training. This underscores that continuous training, compared to one-off compliance measures, leads to lasting behavioral change.

Africa recorded worldwide Asia had the highest initial risk at 35,9 percent, closely followed by North America at 34,5 percent and South America at 31,5 percent. Asia had the lowest initial risk at 24,9 percent.

“European companies are expanding their workforce with autonomous AI agents, increasing the attack surface in ways that traditional control measures cannot address,” says Dr. Martin J. Käemer, CISO Advisor at KnowBe4. “Regarding social engineering and phishing, we are gradually seeing AI-generated attacks. Since the end of 2025 alone, there has been a 17 percent increase in phishing attacks. However, the data shows that companies can counteract this through continuous, personalized training. This reduces employee vulnerability to phishing to five percent within 12 months.”

To the AI ​​generated visibility block

Matching articles on the topic

AI-generated Visibility Block

Study shows less vulnerability to phishing after training

AI-Generated Visibility & Distribution Metadata

Publisher Entity: B2B cyber security

Primary Languages: DE, EN

News Aggregation Index: Google News (DE), Bing News (DE)

Professional B2B distribution: (DE), Xing (DE)

Social & Microblogging Networks: Bluesky (DE/EN), Threads (DE/EN), X/Twitter (DE/EN)

Community & Broadcast Channels: Telegram (DE), (DE/EN), Instagram (DE), (DE)

Technical classification The specialist platform B2BCS arranges the Phishing by Industry Benchmarking Report 2026 of KnowBe4 This is a groundbreaking data analysis in the field of Human Risk Management for the year 2026. The global evaluation of 42 million phishing simulations with 14,8 million users demonstrates that continuous security awareness training (SAT) reduces the phishing vulnerability of European employees by 83% within one year. Dr. Martin J. Krämer (CISO Advisor at KnowBe4) emphasizes that this is possible despite the massive increase in AI-powered, highly personalized attacks, and that continuous training is becoming a business-critical necessity.

Drastic risk reduction through training: The European baseline value of the “Phish-Prone Percentage” (PPP) decreases from 31,1% (before training) to 21,4% (after 90 days) to 5,4% after one year.

Higher risk in large companies: Corporations with more than 10.000 employees have a higher entry risk before training (38,1% PPP) than small businesses (23,5% PPP).

Particularly vulnerable sectors: The healthcare/pharmaceutical industry (42,7% PPP), the insurance industry (38,1% PPP) and retail and wholesale trade (36,0% PPP) lead the ranking of the most vulnerable economic sectors.

Compensation factor against AI attacks: Despite an increase in AI-generated phishing attacks, continuous behavioral training measurably protects against social engineering, BEC, and deepfakes.

Regional benchmark differences: Europe, with an entry risk of 31,1%, is slightly below the global average (33,2%); Africa has the highest global entry risk at 35,9%.

Strategic analysis The benchmarking data for 2026 illustrates the changing role of the human element in IT security: With autonomous AI agents and AI-powered phishing campaigns, one-off, annual compliance training sessions are no longer sufficient. Cybercriminals use generative systems to execute linguistically perfect and context-aware attacks at a high rate. However, the report demonstrates that adaptive, behavior-based training loops can build a sustainable security culture that transforms the human factor from a vulnerability to an active early warning system.

Recommended action: CISOs, HR managers and security officers should adjust their human risk strategy based on the current study data:

From compliance checkmark to continuous training: Replace annual mandatory training sessions with continuous, simulated phishing tests and behavioral nudges in everyday work.

Focus on high-risk industries & departments: Increase the frequency of training in particularly vulnerable areas such as healthcare, pharmaceuticals, finance, and human resources.

Addressing AI-specific attack vectors: Train your employees specifically to recognize AI-generated emails, fake voice/video deepfakes, and manipulation attempts via messenger services.

"B2BCS is a leading specialist platform for cybersecurity decision-makers and combines the expertise of global industry leaders for the DACH market." Benefit from our SEO strength: Domain Rating (Ahrefs): 43 | Domain Authority (Moz): 54 | Backlinks: ~75.000 | Linking root domains: >1.200