KnowBe4 has released the new 2022 Phishing by Industry Benchmarking Report to measure an organization’s Phish-prone Percentage (PPP), which indicates how many of their employees are likely to fall for phishing or a social engineering scam.
With ransomware payments averaging $580,000 in 2021 and business email compromise (BEC) losses topping $1.8 billion in 2020, a cyber attack can wreak havoc on an organization. Yet, according to the baseline testing conducted for the report, without security training, across all industries, 32.4% of employees are likely to click on a suspicious link or comply with a fraudulent request. In some large category industries, such as Consulting, Energy & Utilities, and Healthcare & Pharmaceuticals, the percentage is over 50%.
KnowBe4 analyzed a data set of over 9.5 million users across 30,173 organizations, with over 23.4 million simulated phishing security tests across 19 different industries. The resulting baseline “Phish-proneTM Percentage (PPP)” measures the percentage of employees in organizations that had not conducted any KnowBe4 security training, who clicked a simulated phishing email link or opened an infected attachment during testing.
When companies implemented a combination of training and simulated phishing security testing after their initial baseline measurement, results changed dramatically. In 90 days after completing monthly or more frequent security training, the average PPP decreased to 17.6%. After twelve months of security training and simulated phishing security tests, the average PPP dropped to five percent, indicating that new habits become normal, fostering a stronger security culture.
The report underscores the fact that while technology plays an important role in preventing and recovering from an attack, companies cannot afford to ignore the human factor. Verizon’s 2022 Data Breach Investigations report states that 82% of breaches this year involved the human element.
“In critical industries like Energy & Utilities and Healthcare & Pharmaceuticals where lives can be severely impacted, we found particularly high levels of cybersecurity risk as a result of simulated phishing test failures,” said Stu Sjouwerman, CEO, KnowBe4. “With the steep cost of cyber attacks, this is deeply concerning. Given that most data breaches originate from social engineering, we cannot afford to omit the human element. Implementing security awareness training with simulated phishing testing will help to better protect organizations against cyber attacks and result in a more secure organizational culture.”