The best-funded companies open the most phishing attachments
An employee gets an email dressed as a password reset. She clicks the link, types her credentials into a page built to copy her company’s login screen, and moves on with her morning. She tells no one.
That silence is the exposure. Across 13.9 million simulated phishing messages, one in ten recipients flagged the attempt to their security team. The rest let it through, and a live attacker needs only one of them.
John Wilson, senior fellow for threat research at Fortra, has tracked phishing from its early days of copied login pages into a paid service industry. Phishing-as-a-Service platforms sell templates, hosting, and kits that defeat multi-factor authentication for pocket change. The skill required to run a campaign has fallen to a few clicks.
Wilson counts people as one flawed control among several. “The human layer is already an inadequate control surface, as are technical controls,” he told Help Net Security. “Both can be circumvented by a determined attacker.” His prescription is to keep technology controls updated and users tested on a regular schedule, so both operate at peak performance.
That reporting rate looks reassuring, and it tells you less than you think
The benchmark treats reporting rate as the vital sign of a security program. The reasoning is simple. A single report can kill a campaign mid-flight, and nine in ten simulated attempts produced no report.
The sector data muddies that picture. Financial banks reported phishing at 30.98 percent, the top reporting mark in the study, with a form-completion rate near the bottom.
Defense employees reported at close to a quarter, then clicked simulated links at 13.02 percent. Strong reporting and heavy clicking live in the same workforce.
Wilson lands on one metric above the others. “Although form completion represents the worst outcome for traditional credential phishing, an organization can be compromised by malware through a single click, without the user ever submitting their login credentials,” he said. “For this reason, I believe clickrate is the most important metric when evaluating training effectiveness.”
Wilson weighs each priority in turn. “Prioritizing form entry could lead to a malware infection brought on by a single click, while prioritizing reporting could lead to excessive false positives, overburdening the SOC,” Wilson said. “This has the potential of a critical incident not receiving adequate attention or urgency.”
Chasing the latest lure is a losing game
New phishing techniques ship constantly. Wilson runs threat research at Fortra. His read on what stays fixed:
“While there have been numerous technical innovations in phishing, such as Device Code phishing, Hybrid Vishing, Phishing-as-a-Service, Service Abuse, and OAuth client ID spoofing, the underlying social engineering techniques of urgency, authority, fear, greed, etc. haven’t changed,” he said. “Phishing simulation training needs to focus on these core social engineering techniques, rather than any specific phishing lures, which will no doubt continue to adapt and evolve over time.”
Training built on this week’s template ages by next week. Training built on urgency and authority holds.
Who falls for it depends on where they sit
The same phishing email lands differently depending on who opens it. Language draws one line. French-language recipients in France reported at 19.55 percent, roughly double the English-language cohort.
Industry draws another. Insurance employees opened malicious attachments at 12.65 percent, a rate that towers over every other sector in the study. One habit can define an entire workforce.
Company size draws a third, and this line runs on money. Small and medium businesses clicked more, submitted more passwords, and reported the least. Their training budgets sit in the low six figures. The largest firms spend into eight figures.
What defenders do with this
The employee who typed her password into a fake login page never told her security team. Around 250,000 people did the same across these simulations. That gap is what every phishing kit on the market is built to widen.