7% of VEC engagements came from employees who had engaged with a previous attack.

Conversely, EMEA organisations show the highest reporting rate for BEC, at 4.22%

Employees in large enterprises engaged with malicious vendor messages 72% of the time after reading them, taking follow-up actions such as replying or forwarding.

Repeat engagement with VEC in EMEA is the highest of any region, over twice that of BEC.

The second-ranked industry for VEC engagement rate was the energy/utilities sector (56%).

EMEA organisations demonstrate the lowest reporting rate for VEC, at 0.27%.

Employees in large enterprises engaged with malicious vendor messages 72% of the time after reading them, taking follow-up actions such as replying or forwarding.

The overall reporting rate for advanced text-based email threats was just 1.46%.

Human error, while still significant, has dropped to third place of most concerning threat actors.

Human error, while still significant, has dropped to third place of most concerning threat actors.

83% of respondents agreed that their current SAT tools require substantial effort to operate and maintain.

75% of organizations require employees to complete security awareness training at least quarterly.

While 99% of organizations experienced incidents tied to human error, the vast majority stated they struggle to implement effective, scalable SAT programs.

More than half (53%) of respondents agreed that the effort required to run their current SAT tools outweighs their impact.

96% of organizations see value in using AI to Create dynamic risk scores based on past user behaviour and the types of attacks targeting certain types of users.

95% of organizations see value in using AI to Automate the creation of training videos.

Nearly all of the organizations surveyed (99%) are in favour of including AI in future SAT tools and workflows.

99% of organizations see value in using AI to support automatically generating training campaigns and workflows.

95% of organizations see value in using AI to Conduct conversational coaching by leveraging LLMs.

99% of organizations experienced security incidents linked to avoidable human error.