TAMPA BAY, FLA. -- KnowBe4, the world-renowned cybersecurity platform that comprehensively addresses human risk management, launched its “Phishing by Industry Benchmarking Report 2025” which measures an organization’s Phish-prone™ Percentage (PPP) — the percentage of employees likely to fall for social engineering or phishing attacks, indicating the organization’s overall susceptibility to phishing threats. This year’s report found a global average baseline PPP of 33.1%, meaning a third of employees interact with phishing simulations before taking part in best-practice security awareness training (SAT).

The data underscores the significant impact of SAT in mitigating risk. The rapid decline in the global PPP following the implementation of training — falling by 40% in just three months and by a total of 86% after 12 months — demonstrates that ongoing, effective training leads to lasting behavior change and a substantial reduction in vulnerability to cybersecurity threats. This highlights the critical role of continuous education in building a stronger security culture within organizations, even in as little as three months.

KnowBe4 analyzed 67.7 million phishing simulations globally, across 14.5 million users from 62.4 thousand organizations. The baseline PPP (33.1%) reflects an organization’s susceptibility to phishing before any KnowBe4 training. Employees then undergo KnowBe4’s SAT, and the PPP is recalculated after 90 days and again after one year-plus of ongoing training to quantify the program’s effectiveness.

Other Key Findings from the Phishing By Industry Benchmarking Report:

· Globally, the top three most at-risk industries with the highest baseline PPP were Healthcare & Pharmaceuticals (41.9%), Insurance (39.2%), and Retail & Wholesale (36.5%).
· Larger organizations faced a higher initial phishing risk, with those having 10,000+ employees showing a global baseline PPP of 40.5%, compared to 24.6% for organizations with 1-250 employees.
· In organizations of 1,000-9,999 employees, three sectors all achieved PPP improvement rates of 91% after 12 months of on-going training: Healthcare & Pharmaceuticals, Hospitality and Legal.
· Across the different regions, the highest baseline PPPs were found in South America (39.1%), North America (37.1%), and Australia and New Zealand (36.8%).

“The data speaks for itself — security awareness training truly makes a difference,” said Stu Sjouwerman, CEO of KnowBe4. “From 2024 to 2025, the general trend has remained fairly consistent — around one-third of employees click on a simulated phishing link before taking part in training. However, the data shows a slight improvement in 2025. Within a year, we’ve seen a 3.5% decrease in the global baseline PPP, highlighting a positive shift in overall security awareness worldwide. However, there is still significant progress to be made in fully addressing phishing risks. By consistently prioritizing relevant and engaging training, combined with simulated phishing, organizations can strengthen their human risk management strategies and better protect against phishing to improve overall security culture.”