Phishing click rates need context, Pistachio data suggests
Nearly one in three users in Tech Development clicked at least one phishing simulation during a 12-month programme tracked by phishing-simulation and human-risk vendor Pistachio. The reported figure for IT was 28.53%.
Pistachio reported cumulative click proportions of 30.27% for Tech Development and 28.53% for IT. These figures show that technical departments in this customer dataset also recorded clicks. They do not establish the participants’ individual experience or technical ability.
The more important finding, however, is about measurement. A cumulative annual click figure does not reveal the per-message click rate, the nature of the action taken or whether employees increasingly recognised and reported suspicious messages. Nor can it show, in isolation, whether a workforce became more or less resilient during the year.
The denominator matters
Pistachio announced The Phishing Behaviour Report 2026 on 10 September. The company says 2,473,158 phishing simulations were sent across 1,288 organisations on its platform over 12 months.
Its like-for-like analytical cohort was narrower. According to Pistachio, the reported findings came from 648 organisations with complete records for the full year, covering 123,692 users. The public material does not make clear how the total volume of 2.47 million simulations was divided between the wider platform population and that complete-record cohort.
That distinction prevents the largest numbers from being combined into a more precise-looking rate than the evidence supports. The public summaries also do not disclose how many simulations each user received, how clicks and repeat actions were counted or the underlying department sample sizes.
The 30.27% and 28.53% figures therefore describe the proportion of users in each named department who clicked at least once during the year. They are not per-message click-through rates, and they do not mean that almost a third of either group clicked the same test. Without the underlying department sizes, the two percentages cannot responsibly be merged into a single rate for technology workers.
A click is one part of the result
Pistachio argues that organisations should assess clicks alongside simulated credential entry, employee reporting and the difficulty of each test. That approach recognises that different actions inside a controlled exercise represent different outcomes.
The vendor says 1.57% of users entered credentials into a simulated page during their first test. This was not the theft of live credentials, unauthorised access or evidence of a security breach. The report concerns controlled messages generated through Pistachio’s platform, not a real phishing campaign, and it documents no production compromise, service disruption, financial loss or customer-data impact.
Reporting supplies another view of behaviour. By the 12-month stage, Pistachio says users were reporting suspicious messages nearly twice as often as they clicked them. That ratio adds information which a click total alone would discard, but the available public material does not demonstrate that the programme caused an improvement or connect simulation reporting to fewer real-world incidents.
This matters when organisations use a single headline percentage as a scorecard. Cumulative annual incidence answers whether a user clicked at least once across a series of tests. A per-message rate would answer a different question about the frequency of clicks across the messages sent. Simulated credential submission and reporting behaviour measure different responses again. None is interchangeable with an actual compromise.
Harder tests complicate the trend
Pistachio reports that click and simulated credential-entry rates peaked around the six-month point. That stage of the programme also contained the highest proportion of tests classified as difficult.
The company interprets the increase as harder simulations exposing risk that easier tests had not revealed, rather than evidence that users became less secure. The public material partially supports that account by showing the peak coincided with the highest share of difficult tests, but it does not independently prove causation. The public summaries do not disclose the controls or statistical analysis needed to isolate test difficulty from other possible differences over time.
A rising click rate can consequently have more than one interpretation when the tests themselves change. Comparing the sixth month with an earlier or later stage without accounting for difficulty could make performance appear to deteriorate even if the underlying behaviour had not changed. Conversely, a falling rate based on easier tests would not necessarily demonstrate greater resilience.
Department comparisons carry a similar requirement. Across 18 departments that Pistachio says received a broadly similar mix of test difficulty, cumulative click proportions ranged from 26.35% in Design to 41.31% in Construction. The figures show a wide descriptive range within this customer dataset, but the public summaries do not disclose confidence intervals, significance testing or adjustments for unequal department samples.
Explanations offered outside the main findings should be treated more cautiously. Pistachio chief executive and co-founder Joe Jones told Inc. that lack of attention was the largest predictor of whether somebody fell for a simulation, and that susceptibility increased as a message became more relevant to normal work. Those claims remain unverified because the public methodology reviewed does not show attention or lure relevance being measured as tested predictors.
Inc. also linked the technical-team results to increasingly sophisticated AI-enabled phishing. The report summaries do not disclose a comparison between AI-generated and non-AI simulations, so the dataset cannot establish AI as the cause of the recorded clicks.
Vendor telemetry, not a universal benchmark
The scale of Pistachio’s dataset gives organisations a useful example of why phishing exercises require several measures. It does not make the reported percentages universal benchmarks. Pistachio sells phishing-simulation and human-risk services to the organisations represented in its platform telemetry. The evidence is therefore vendor-generated and limited to its customer population, with commercial incentives that readers should consider.
The public summaries do not provide the cohort’s geographic distribution, organisation-size criteria, industry composition or attrition detail. No Australian subset or country-level results were disclosed, so the percentages should not be presented as findings about Australian workers. Their relevance to Australian organisations lies in the measurement problem, not in a demonstrated local prevalence rate.
This also differs from The Hack Academy’s 2025 coverage of separate research questioning the effectiveness of conventional phishing training. The studies involved different populations, programmes and outcomes, and their results cannot be directly reconciled. Pistachio’s distinct contribution is department-level telemetry and the argument that clicks, credential entry, reporting and test difficulty must be interpreted together.
The remaining methodological question is how the 2.47 million simulations across 1,288 platform organisations relate to the 648-organisation complete-record cohort used for the reported findings. Until that relationship, event-counting rules, user exposure, geographic composition and statistical treatment are disclosed more fully, organisations should avoid treating the headline figures as universal targets.
A useful question for any phishing click percentage is whether its denominator and measured behaviour match the conclusion being drawn. Pair that measurement discipline with broader technical study in The Hack Academy’s online cybersecurity training programme, which offers self-paced learning and practical exercises alongside theory in listed subjects including cybersecurity fundamentals.
