Phishing Simulation Benchmarks: How Does Your Organization Compare?
Phishing simulation benchmarks help organizations evaluate their security awareness and identify areas for improvement. Learn how to use these benchmarks to strengthen your defenses.
On this page 5 sections
Phishing simulation benchmarks should come from independent datasets, not vendor marketing. The Verizon 2026 DBIR reports median click rates of ~1.4% for email simulations and ~2% for phone-centric scenarios (~40% higher, p. 50). Use these medians to grade cohorts, not to celebrate low single-digit clicks alone.
Phishing simulation benchmarks at a glance (2026)
| Channel | Median click rate | Use in benchmarking |
|---|---|---|
| ~1.4% | Default SAT baseline | |
| Phone / SMS / voice | ~2% | Multi-channel programs |
| Gap | ~40% higher on phone | Justifies vishing/smishing sims |
How to compare your organization
Benchmark by role and channel. Finance and help-desk cohorts often exceed company-wide medians on callback and BEC templates. Pair click data with reporting rate and time-to-report. Gartner found that 84% of security leaders track training completion as a top metric (G00840741, n=65), while fewer than 10% of breaches at midsize enterprises involve phishing (G00811878).
Why this matters
A 1.2% email click rate means little if phone sims fail at 4% and nobody reports.
What security leaders should do
Publish channel-specific medians in QBRs. Cross-check with SBCP metrics and phishing statistics 2026.
Cohort reporting benchmarks
Track repeat-failure cohorts after each campaign. Compare year-over-year medians against DBIR published sim statistics, not against arbitrary industry blog percentages.
Related reading
Sources
- Verizon 2026 DBIR summary
- Gartner G00811878, G00840741 (2025 and 2026).
Frequently asked questions
Benchmarks are reference rates for clicking, credential submission and reporting that let an organisation compare its results against a wider population rather than only against its own last campaign.
The median click rate for email simulations is around 1.4%, and phone centric simulations fail at roughly 40% higher rates (Verizon, 2026 Data Breach Investigations Report, 2026, p. 50).
Only with caution. Scenario difficulty, industry, audience and even how a click is counted vary between programmes, so a benchmark sets context rather than a target.
Your own trend, segmented by department and by channel. The useful question is whether reporting is rising and time to report is falling in the groups that carry the most risk.
Susceptibility by channel, reporting rate, time to report, repeat exposure, and how those move across quarters. Completion counts belong in a compliance record rather than a risk report.
Quarterly is enough to see a trend. Monthly comparison usually measures scenario variation rather than any change in behaviour.
Schedule your 30-minute demo now
You'll learn how to:
- Implement custom phishing simulations tailored to your organization's needs.
- Track and analyze key metrics to benchmark your organization against industry standards.
- Develop targeted security awareness training to boost employee resilience.
30 minutes with a Keepnet specialist, on your own use cases.
Author
Ozan Ucar
Founder and CEO, Keepnet
Ozan founded Keepnet in 2017 and has worked in cyber security since 2006. He leads Keepnet's product direction and works with security teams on measuring and changing the behaviours behind incidents.