After one year or more of sustained training, the average Phish Prone Percentage (PPP) for small institutions dropped dramatically to 3.9%.

For large organisations, the average Phish Prone Percentage (PPP) after one year of sustained training dropped to 4.9%.

For large educational institutions with more than 1,000 employees the baseline Phish Prone Percentage (PPP) was 31.7%.

The median time to click on a malicious link after the email is opened is 21 seconds.

KnowBe4's 2024 Phishing by Industry Benchmarking Report found that in the education sector specifically, the baseline PPP (Phish Prone Percentage) for small organisations (1-249 employees) was 33.4%.

HTML attachments make up 82% of malicious email attachments in the education sector

It takes only another 28 seconds to enter the data after clicking a malicious link.

42% of organisations reported phishing and social engineering attacks in 2024.

84% of attacks against energy and utilities sector originated from phishing.