Companies that judge phishing simulation programs by how often employees click simulated attack emails may be overlooking more important indicators of cyber resilience, according to Pistachio’s Phishing Behaviour Report 2026.
Examples of difficult simulations (Source: Pistachio)
The analysis covered 648 organizations with a complete 12-month record and 123,692 users between June 1, 2025, and May 31, 2026. Its central finding is that phishing resilience is better understood through a combination of clicking, credential submission, and reporting behavior.
Progress does not follow a straight line
Phishing performance can appear to worsen during a training program. Across 354,962 simulations included in the journey analysis, click and credential-submission rates increased through the first six months before declining at later stages. Reporting followed a similar pattern.
These stages do not track the same employees continuously over 12 months. Instead, they compare overlapping but non-identical groups of organizations and users that had reached the three-, six-, nine- and 12-month stages of their programs.
At six months, users received an average of 3.5 simulations per person, compared with 2.6 at three months and 2.8 at 12 months. At the same time, 50.4% of simulations were classified as Hard. After the six-month stage, the difficulty mix remained at roughly 50% Hard while clicking and credential submission declined.
The temporary increase in clicks can reflect more demanding and frequent testing that exposes vulnerabilities easier exercises may miss, instead of indicating that employees are becoming less resilient.
“A low click rate can create a false sense of security. Clicking a phishing link is just one moment in a much longer chain of employee behaviour, and on its own it says little about whether someone, or the organisation as a whole, is actually getting more resilient. What matters more is what happens next: does the employee hand over credentials, recognise the attack and stop, or report it so the wider business can act?,” said Joe Jones, CEO of Pistachio.
Test design also affects how results should be interpreted. Repeated use of familiar phishing templates can produce falling click rates because employees learn to recognize the exercises, without necessarily becoming better prepared for unfamiliar attacks. A lower click rate is therefore more meaningful when it occurs against simulations that remain challenging.
Reporting turns employees into a detection channel
Avoiding a phishing link limits one source of risk. Recognizing a suspicious message and alerting the security team adds another layer of protection by turning employees into an active detection channel.
From the six-month peak to the 12-month stage, clicks declined by 27% and credential leaks by 41%, while reports declined by 19%. The report-to-click ratio increased from 1.3 at three months to 1.8 at 12 months, meaning suspicious messages were reported almost twice as often as they were clicked at the final stage.
Reporting gives security teams earlier visibility into potential attacks and an opportunity to investigate and remove similar messages from other inboxes, extending the benefit beyond the employee who raised the alert.
Making the process easy can encourage employees to act. One-click reporting and timely confirmation can help users flag potential threats without adding unnecessary friction.
Different teams carry different risks
A company-wide score can mask substantial differences between departments. Hard simulations accounted for 44% to 52% of sends across the 16 named departments, meaning no department received a systematically easier or harder mix of tests.
Construction and Facility Management showed the greatest exposure to clicking and credential submission. Construction recorded a 41.31% cumulative click rate and a 16.47% leak rate, the highest departmental figures in the dataset. These annual user-level measures represent the proportion of users who clicked or submitted credentials at least once during the analysis year, instead of the percentage of individual phishing messages that produced those actions.
Health presented a different risk profile. Its click rate was comparatively low, but its 13.17% report rate was the lowest of any named department. Logistics combined an above-average click rate with a below-average report rate of 17.11%, suggesting that its exposure was not being offset by reporting.
Employees in IT and Tech Development still engaged with simulated phishing attempts, showing that awareness does not always lead to the appropriate response when a suspicious message arrives.
The departmental differences also make a case for more targeted training. Teams that struggle to recognize suspicious messages may require different exercises from those that identify a phishing attempt but still enter credentials. An organization-wide click score alone cannot distinguish between those behaviors or show where additional training is most needed.
