Phishing Research Challenges Conventional Security Awareness Testing
Pistachio research reveals phishing simulations should measure credential leaks and reporting, not just clicks.
Pistachio's research analyzed 2.47 million simulated phishing attacks across over 1,200 organizations. The findings challenge conventional security awareness testing by showing that click rates alone are a poor indicator of actual risk. The study emphasizes the importance of measuring credential leaks and user reporting alongside clicks to gain a true understanding of an organization's phishing resilience.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Pistachio?
Get an email when a new story names Pistachio, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOrganizations have long relied on phishing simulation click rates as the primary metric for measuring employee security awareness, but new research shows this approach is fundamentally flawed. Analyzing 2.47 million simulated attacks, Pistachio's study found that click rates fail to capture the full risk picture — credential submission rates and user reporting behaviors are far more predictive of real-world vulnerability. An employee who clicks but doesn't submit credentials represents a very different risk profile than one who hands over their password. Without measuring the right indicators, security teams may have a false sense of confidence in their workforce's resilience. This matters because phishing remains one of the leading initial access vectors in breaches, and miscalibrated training programs leave critical gaps unaddressed.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.