The message is simple: fine-tune future in-house phishing simulation tests through the findings and analysis of Pistachio’s research.
Pistachio was founded in Oslo Norway in 2019, with additional offices in London and Valencia. It specializes in automated human risk management, employee security awareness training, and phishing simulations. Between 1 June, 2025 and 31 May, 2026, Pistachio sent 2.47 million simulated phishing attempts to more than 123,000 employees in more than 1,200 organizations. Its subsequent analysis looked at clicking, leaking, and reporting.
Thirty percent of tech development and IT employees clicked at least one of these phishing simulations. Nearly 20% of construction and real estate employees leaked credentials after a successful phishing attempt. Financial services were the most resilient, outperforming all other sectors in click, credential leaking and reporting rates.
While it is not surprising that financial services performed better, it is more surprising that tech and IT (who really should know better) did so poorly. The differences outlined in the report suggest that organizations do not have a single phishing risk profile. The proportion of employees who clicked at least once ranged from 26% in Design to 41% in Construction.
Pistachio’s simulated phishing attacks were delivered through its own AI-driven training platform via channels including email and Teams. Content and difficulty was based on the recipient’s role within the company and how they had previously responded during other simulated phishing attempts. (As an aside, this demonstrates the power of artificial intelligence. Had the process been performed manually, it would have taken 23 years rather than 12 months to complete.)
However, the report also demonstrates the importance for simulated phishing tests to look beyond user clicking to user response. A click on its own is merely a waste of employee time with no significant phishing risk. It is the submission of credentials or other requested information that creates the phishing risk. This in turn warns that in-house phishing tests may provide organizations with a misleading idea of true phishing resistance.
“Click rate, the metric most phishing programs are judged on, is only part of the picture. A strong indicator of improvement needs to go beyond click rate, and should look at how click, leak and report behaviors change together over time,” explains the report.
Joe Jones, CEO and co-founder at Pistachio, explains further: “A low click rate can create a false sense of security. Clicking a phishing link is just one moment in a much longer chain of employee behavior, and on its own it says little about whether someone, or the organization as a whole, is actually getting more resilient. What matters more is what happens next: does the employee hand over credentials, recognize the attack and stop, or report it so the wider business can act?”