Phishing Simulation Click Rate Benchmarks: 33%, 5%, or 4%? Why They Disagree

The most cited phishing simulation click rate benchmarks are KnowBe4's 33.1% for untrained employees, 19.9% after 90 days, and 4.1% after 12 months, and Fortra's 5.42% average click rate. They disagree because they measure different emails, people, and methods. Your own click rate says more about your templates than your people.

The published numbers, straight

KnowBe4's 2025 Phishing by Industry Benchmark covers 67.7 million simulations, 14.5 million people, and 62,400 organizations. Its headline figures:

• 33.1% of employees clicked at baseline, before any training
• 19.9% clicked after 90 days of training and simulations
• 4.1% clicked after 12 months

Source: KnowBe4 2025 benchmark announcement.

Fortra's 2025 Phishing Simulation Benchmark, published in June 2026, covers 14 million recipients across 7,500+ simulations. It found a 5.42% click rate, a 1.99% credential submission rate, and a 10.5% reporting rate. Source: Fortra 2025 Phishing Simulation Benchmark.

So if someone asks "what's a good click rate," the honest short answer is: somewhere between 4% and 33%, depending on whose data, which emails, and which month of the program you're in. That spread is the story.

Why a 33% and a 5% can both be true

Both reports are large and both are real. They still can't be laid side by side.

KnowBe4's 33.1% is measured before training starts. Fortra's 5.42% is one average across every simulation in its dataset, whatever stage each program was at. Different starting points, different template libraries, different ways customers pick difficulty. A company that sends easy simulations will post a low number. A company that sends hard ones will post a high number. Neither tells you much about how those employees handle a real attack.

NIST saw this coming. Its Phish Scale research (Steves et al., 2020) showed click rates swing with how hard an email is for a given audience. A click rate without a difficulty rating is a number without units.

The study that should change how you read benchmarks

In 2026, Rozema and Davis published a study of 12,511 employees at WWW '26. They rated every simulation with the NIST Phish Scale. Two findings matter here.

Difficulty predicted clicks. Easy emails drew about 7% clicks. Hard emails drew about 15%. Same organization, same people, roughly double the rate, just from the email.

And training didn't move the needle. The authors found no significant training effect on clicks or reports. Their paper's title says it plainly: anti-phishing training still does not work.

That's hard to square with a vendor chart that drops from 33.1% to 4.1%. It isn't proof the vendor chart is wrong. It is a strong hint about what the chart is measuring.

A falling click rate can mean the wrong thing

Here's the uncomfortable part. When click rates fall steeply over a year, one likely cause is that employees learned to spot your simulations. Same sender patterns. Same platform headers. Same "your package is delayed" theme every quarter. People get good at the program, not at phishing.

Other research points the same way. Lain et al. followed 14,000+ employees for 15 months and found that embedded training shown after a failed simulation did not improve resilience, and could make some people more susceptible. Ho et al. (2025) found that recent completion of annual training had no significant link to failing simulations.

If you report a falling click rate to leadership as proof your people are safer, you may be reporting that your templates got stale.

The benchmark worth comparing: reporting

Look again at Fortra's numbers. 10.5% of recipients reported the simulation. That's nearly double the 5.42% who clicked. Reporting is the behavior that actually protects a company, because one early report lets IT pull the email from every other inbox.

Rozema and Davis found that in 36% to 55% of simulations, a report arrived before the first click. Lain et al. described employee reporting as a fast, sustainable, crowd-sourced detection system. That's the number to chase.

At Hook we call it SERR, the Suspicious Email Reporting Rate. Two things to track:

• Reporting rate: what share of recipients reported the simulation
• Time to first report: how many minutes until the first person flagged it

The second one is underrated. A 4% click rate with a first report at minute 90 is worse than an 8% click rate with a first report at minute 3. We wrote more on that in the reporting race.

How to compare yourself fairly

If you still need a click rate for a board slide or a client QBR, at least make it honest.

Rate difficulty. Score each simulation with the NIST Phish Scale before you send it. Report results by difficulty band, not as one blended number.

Compare like with like. Only compare your easy-email results to someone else's easy-email results. Never put your hard-template month next to a vendor's all-in average.

Track by manipulation tactic. Group results by the pressure the email applies. We use six manipulation tactics: urgency, scarcity, trust, helpfulness, authority and social proof. "Our people report authority-based emails twice as often as urgency-based ones" is something you can act on. "We're at 6%" isn't.

Rotate templates. Vance et al. found attention to repeated warnings drops over a workweek, and that varied designs reduce habituation. The same logic applies to simulations.

Our guide on how to run a phishing simulation walks through setup with these in mind.

Where Hook fits

Hook Security is a security awareness training and phishing simulation platform built for MSPs and SMBs. We train 250,000+ employees a month across 500+ accounts. Autopilot runs training and simulations automatically each month, and we treat SERR as the primary metric, with clicks as learning moments. That's PsySec, our research-backed approach, in practice.

FAQ

What is a good phishing simulation click rate?

There's no single good number. Published benchmarks range from 4.1% (KnowBe4, after 12 months) to 33.1% (KnowBe4, untrained baseline), with Fortra at 5.42%. Compare by difficulty, and put more weight on your reporting rate.

What is the average phishing click rate in 2026?

The most recent large dataset, Fortra's 2025 benchmark published June 2026, reports a 5.42% click rate and 1.99% credential submission across 14 million recipients. KnowBe4's 2025 report puts the untrained baseline at 33.1%.

Why did our click rate go up this month?

Often, the simulation was harder. Rozema and Davis found hard emails drew about 15% clicks versus about 7% for easy ones in the same organization. Check the template's Phish Scale rating before drawing conclusions about your people.

What should I benchmark instead of click rate?

Reporting rate and time to first report. Fortra's data shows 10.5% of recipients reporting, about twice the click rate, and an early report protects everyone else in the inbox.