Phishing simulation: 1 in 3 employees fall for it before training
Before any training, one employee in three clicks on a fake email. What the data says, and why hands-on cyber awareness training makes the difference.
In phishing simulations run before any training, roughly one employee in three clicks the malicious link, opens the attachment or types their password into a fake login page. That is the finding of KnowBe4's 2025 report, which compiles simulations run by its customers worldwide.
After a year of regular training? The rate drops to around 4%.
So the question isn't whether your team would fall for it, but how often.
Did you know?
According to KnowBe4 (2025), the average simulation click rate falls from 33.1% before training to 4.1% after twelve months of awareness training and regular simulations. The drop already exceeds 40% after 90 days. These are figures from a training vendor, best read as an order of magnitude.
The problem isn't technical, it's human
Your company has a firewall, antivirus, maybe even a SOC. Yet according to the Verizon DBIR 2026, the human element is involved in 62% of data breaches: a click on a link, a reused password, a misdirected email, manipulation over the phone.
No technology fully protects against that.
Fraudsters know it. They exploit urgency ("Your account will be locked in 2 hours"), authority ("The CEO needs an urgent transfer") and curiosity ("See who viewed your profile"). In Belgium, nearly 10 million suspicious messages were reported to Safeonweb in 2025.
The same Verizon report shows that attacks by text message and phone work better than email: in simulations, the median click rate on those channels is around 40% higher. Awareness training limited to email is no longer enough.
What actually works
An annual presentation changes little. What works is repeated practice: realistic phishing simulations, social engineering exercises where your teams learn to spot manipulation techniques, password and MFA workshops where everyone tests their own habits.
We deliver lunch & learns, half-days or conferences. Short format, lasting impact. Every participant leaves with practical habits, not slides to forget.
Our Cyber Awareness training is designed for exactly that. To measure the effect, track a few simple indicators before and after: simulation click rate, suspicious email reporting rate, share of accounts protected by MFA.
If your company falls under NIS2, staff cybersecurity training is one of the minimum measures, and members of the management body must undergo training themselves.
We're not asking you to turn your employees into cyber experts. Just to give them the right habits so your team becomes your first line of defence.
Take action
Your people are your best antivirus, or your biggest weakness. The choice is yours.
- Measure the risk with our free cyber diagnostic
- Train your teams with our Cyber Awareness training
- Let's discuss your context: contact us for a programme tailored to your industry
