Around a third of employees without cybersecurity training are likely to fall for phishing attacks, new research has warned.

The statistic can be found in cybersecurity trainers KnowBe4’s new 2022 Phishing by Industry Benchmarking Report. This measures an organisation’s Phish-prone Percentage (PPP), which indicates how many of their employees are likely to fall for a phishing or social engineering scam.

The resulting baseline PPP measures the percentage of employees in organisations that had not conducted any KnowBe4 security training, who clicked a simulated phishing email link or opened an infected attachment during testing.

According to the baseline testing conducted for the report, without security training, across all industries globally, 32.4% of employees are likely to click on a suspicious link or comply with a fraudulent request.

In some large category industries, such as consulting, energy & utilities, and healthcare & pharmaceuticals, the percentage is over 50%.

However, when organisations implemented a combination of training and simulated phishing security testing after their initial baseline measurement, the results changed.

90 days after completing monthly or more frequent security training, the average PPP decreased to 17.6%. After twelve months of security training and simulated phishing security tests, the average PPP dropped to 5%.

Recommended

• Nicola Sturgeon leads the line in unveiling Scotland’s Tech Scalers
• Amazon plans to create 4,000 new UK jobs
• Crypto winter bites as OpenSea announces layoffs

“In critical industries like energy & utilities and healthcare & pharmaceuticals where lives can be severely impacted, we found particularly high levels of cybersecurity risk as a result of simulated phishing test failures,” said KnowBe4 CEO Stu Sjouwerman.

“With the steep cost of cyberattacks, this is deeply concerning. Given that most data breaches originate from social engineering, we cannot afford to omit the human element. Implementing security awareness training with simulated phishing testing will help to better protect organisations against cyber-attacks and result in a more secure organisational culture.”

KnowBe4 analysed a data set of over 9.5 million users across 30,173 organisations, with over 23.4 million simulated phishing security tests across 19 different industries.

The company warned that ransomware payments averaged $580,000 in 2021 and business email compromise (BEC) losses topped $1.8 billion in 2020.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.