Companies may be measuring phishing resilience the wrong way

Companies may be measuring phishing resilience the wrong way
Pistachio’s Phishing Behaviour Report 2026 finds that phishing resilience should be measured by clicks, credential submission, and reporting together, not by click rates alone. The report also shows that performance can change over time and vary widely by department, with construction, health, logistics, and IT all showing different risk patterns. #Pistachio #PhishingBehaviourReport2026 #Construction #FacilityManagement #Health #Logistics #IT #TechDevelopment

Keypoints

  • Click rates alone can give a false sense of security.
  • Credential submission and reporting are key measures of resilience.
  • Phishing performance may worsen early in training before improving later.
  • Easy reporting helps employees act as an active detection channel.
  • Department-level results show that targeted training is more effective than a company-wide score.

Read More: https://www.helpnetsecurity.com/2026/09/11/pistachio-employee-phishing-risk-report/