The global average Phish-prone Percentage (PPP) is 33.2% before training.

Publisher	KnowBe4
Report	Phishing by Industry Benchmarking Report 2026 Edition
Published	7 July 2026
Topics	Phishing, Employee Behavior

Published by KnowBe4 in Phishing by Industry Benchmarking Report 2026 Edition, 7 July 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Compare this across sources

5 sources answer what share of organisations experienced a phishing attack. They report between 38% and 76%, with a median of 42%.

See all 5 sources

Related statistics

Malicious email (26%) and phishing (24%) together account for 50% of ransomware incidents.

Sophos, 18/07/2026

36% of restaurants experienced phishing targeting staff credentials as a form of social engineering in the past year.

VikingCloud, 12/07/2026

Only 28% of the MFA used for workforce authentication in financial services is phishing-resistant.

Secret Double Octopus, 12/07/2026

After 90 days of security awareness training, the global average PPP drops to 20.1%.

KnowBe4, 12/07/2026

The three industries with the highest baseline PPP are Healthcare & Pharmaceuticals at 42.7%, Insurance at 38.1%, and Retail & Wholesale at 36%.

KnowBe4, 12/07/2026

Baseline PPP by region is: Africa 35.9%, North America 34.5%, South America 31.5%, and Asia 24.9%.

KnowBe4, 12/07/2026

Get the newsletter

Weekly cybersecurity statistics by email.