The message is simple: fine-tune future in-house phishing simulation tests through the findings and analysis of Pistachio’s research.
Pistachio was founded in Oslo Norway in 2019, with additional offices in London and Valencia. It specializes in automated human risk management, employee security awareness training, and phishing simulations. Between 1 June, 2025 and 31 May, 2026, Pistachio sent 2.47 million simulated phishing attempts to more than 123,000 employees in more than 1,200 organizations. Its subsequent analysis looked at clicking, leaking, and reporting.
Thirty percent of tech development and IT employees clicked at least one of these phishing simulations. Nearly 20% of construction and real estate employees leaked credentials after a successful phishing attempt. Financial services were the most resilient, outperforming all other sectors in click, credential leaking and reporting rates.
While it is not surprising that financial services performed better, it is more surprising that tech and IT (who really should know better) did so poorly. The differences outlined in the report suggest that organizations do not have a single phishing risk profile. The proportion of employees who clicked at least once ranged from 26% in Design to 41% in Construction.
Pistachio’s simulated phishing attacks were delivered through its own AI-driven training platform via channels including email and Teams. Content and difficulty was based on the recipient’s role within the company and how they had previously responded during other simulated phishing attempts. (As an aside, this demonstrates the power of artificial intelligence. Had the process been performed manually, it would have taken 23 years rather than 12 months to complete.)
However, the report also demonstrates the importance for simulated phishing tests to look beyond user clicking to user response. A click on its own is merely a waste of employee time with no significant phishing risk. It is the submission of credentials or other requested information that creates the phishing risk. This in turn warns that in-house phishing tests may provide organizations with a misleading idea of true phishing resistance.
“Click rate, the metric most phishing programs are judged on, is only part of the picture. A strong indicator of improvement needs to go beyond click rate, and should look at how click, leak and report behaviors change together over time,” explains the report.
Joe Jones, CEO and co-founder at Pistachio, explains further: “A low click rate can create a false sense of security. Clicking a phishing link is just one moment in a much longer chain of employee behavior, and on its own it says little about whether someone, or the organization as a whole, is actually getting more resilient. What matters more is what happens next: does the employee hand over credentials, recognize the attack and stop, or report it so the wider business can act?”
Pistachio found several test effects that challenge conventional security awareness training:
More users report than click on their first simulation, but 1.57% still leak credentials. That means a company with 500 employees likely has 8 people who will hand over their login details.
Technical teams are not automatically low risk. In the Pistachio testing program, 30.27% of tech development users and 28.53% of IT users clicked at least once. The same test produces different results in different teams: click rates ranged from 26.35% in Design to 41.31% in Construction.
Phishing resilience is the result of fewer clicks and leaks, and more reporting. By the end of the 12 month program, users reported suspicious emails nearly twice as often as they clicked them, showing that effective and sustained programs can build vigilance, and not just fewer clicks. However, the training must be sustained beyond a single sending of simulated attacks: in the Pistachio test, click and leak rates rise through the first six months of the program before beginning to decline.
It is worth noting that the size of the Pistachio program implies that it is multi-national in extent, but it has no ‘geographic analysis. This is disappointing. While the analysis highlights differences in industry sectors and teams, it does not differentiate between geolocations. To be fair, there is no general proof that different global areas are any better or worse in phishing susceptibility, but this research could confirm or deny it. In the worst case scenario, it could perhaps indicate whether global organizations should provide additional training to individual locations.
Overall, this is a report that should be consulted before any phishing simulation test is developed, whether in-house or through Pistachio’s own services.
Related: Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
Related: New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser
Related: New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets
Related: Over 500 Organizations Hit in Years-Long Phishing Campaign
