Security Awareness Training Statistics 2026: 25 Verified Numbers (and 3 We Refuse to Cite)

Updated August 2026 · Every statistic below links to its primary source. Vendor-published research is labeled as such.

The short version: 62% of breaches still involve the human element (Verizon DBIR 2026). AI-written phishing gets 4.5x more clicks than human-written phishing (Microsoft, 2025). And training works — phishing susceptibility drops roughly 79% after 12 months of continuous training (KnowBe4 benchmark data) — but the effect fades within about 6 months without reinforcement (peer-reviewed, USENIX). That's the case for security awareness training that actually runs, continuously, in 25 numbers.

The headline numbers

1. 62% of breaches involved the human element — Verizon, 2026 Data Breach Investigations Report. (60% in the 2025 edition — stable, stubborn, and the reason this category exists.)
2. $20.9 billion in cybercrime losses were reported to the FBI in 2025 across 1,008,597 complaints — and phishing/spoofing was the #1 most-reported crime (191,561 complaints). — FBI IC3, 2025 Internet Crime Report.
3. People are 4.5x more likely to click an AI-generated phishing email — 54% click-through vs. 12% for human-written ones. — Microsoft Digital Defense Report 2025.
4. The average U.S. data breach now costs a record $10.22 million (global average: $4.44M). — IBM Cost of a Data Breach Report 2025.

Small business risk

1. Ransomware was present in 88% of breaches at small businesses — versus 39% at large organizations. — Verizon 2025 DBIR SMB Snapshot.
2. 81% of small businesses experienced a security or data breach in 2025. — Identity Theft Resource Center, 2025 Business Impact Report.
3. 62.5% of breached small businesses took a financial hit over $250,000 — and more than a third of those exceeded $500,000. — ITRC 2025.
4. AI-powered attacks were a root cause in over 40% of cyber events hitting small businesses in 2025. — ITRC 2025.
5. 94% of SMBs have experienced at least one cyberattack (up from 64% in 2019), and 78% fear a severe attack could put them out of business. — ConnectWise State of SMB Cybersecurity (Vanson Bourne survey).
6. 38.3% of small business leaders raised prices to cover cyber-incident costs — a hidden "cyber tax" passed to customers. — ITRC 2025.

The numbers above all point the same direction: consistent practice changes behavior. Hook Security trains teams with realistic phishing simulations and short, genuinely funny lessons employees actually watch - all on autopilot. See it in a demo.

Does training actually work?

1. Untrained employees fail phishing simulations at a 33.2% baseline rate — falling to 4.2% after 12 months of continuous training, a 79% reduction. — KnowBe4 2026 Phishing by Industry Benchmarking Report (vendor research: 42M simulations, 64,000 organizations).
2. The first 90 days of training alone cut susceptibility ~40%. — KnowBe4 2026 (vendor research).
3. Training effects fade back toward baseline in roughly 6 months — peer-reviewed field research recommends reinforcement at least every 6 months, and found video-based and interactive refreshers worked best. — Reinheimer et al., USENIX SOUPS 2020. (This is the peer-reviewed heart of the argument for continuous, engaging programs over annual compliance training.)
4. Continuous behavior-change training cut malicious link clicks 87% in 6 months and drove 6x more threat reporting. — Hoxhunt Phishing Trends Report 2026 (vendor research).
5. Trained employees become detectors, not just liabilities: 64% report at least one REAL phishing threat within 12 months of continuous training. — Hoxhunt 2026 (vendor research).
6. It takes at least 2.8 dedicated full-time staff to meaningfully change security behavior — one big reason SMBs hand awareness programs to MSPs or managed providers. — SANS 2025 Security Awareness Report (2,700+ practitioners surveyed).

Phishing & the threat landscape

1. 971,181 phishing attacks were observed in Q1 2026 alone — up 13.8% quarter over quarter. — APWG Phishing Activity Trends Report.
2. Business email compromise cost $3.05 billion across 24,768 complaints in 2025. — FBI IC3.
3. Mobile social engineering attacks succeed 40% more often than traditional email phishing. — Verizon DBIR 2026.
4. 48% of breaches involved a third party — up 60% year over year. — Verizon DBIR 2026.
5. 82.6% of analyzed phishing emails showed some use of AI. — KnowBe4 Threat Labs, 2025 (vendor research).
6. 16% of data breaches involved attackers using AI, most often for phishing or deepfake impersonation. — IBM 2025.
7. A single deepfake video call cost engineering firm Arup $25 million — an employee wired the money after a video conference with an AI-generated "CFO." — Arup-confirmed, reported May 2024.
8. Deepfake-driven fraud losses in the U.S. are projected to reach $40 billion by 2027. — Deloitte Center for Financial Services.
9. Employee use of unapproved "shadow AI" tools tripled in a year — from 15% to 45%. — Verizon DBIR 2026.

Three famous statistics we refuse to cite

You've seen these everywhere. We won't use them, and here's why:

• "60% of small businesses close within 6 months of a cyberattack." The organization it's attributed to (the National Cybersecurity Alliance) publicly disavowed it years ago. No underlying study exists. Use the ConnectWise sentiment finding instead: 78% of SMBs fear a severe attack could close them — that one's real.
• "43% of cyberattacks target small businesses." Traces to a ~2015 spear-phishing figure recycled for a decade without a current primary source. Verizon's SMB Snapshot gives you real, current numbers.
• "95% of breaches are caused by human error." A garbled citation chain. The defensible, precisely-defined figure is Verizon's human-element number: 62%.

If a vendor leads with any of these three, ask what else they didn't check.

Three questions to ask about your own program

How often does training happen? Training effects fade within about six months without reinforcement (USENIX SOUPS). Once-a-year training leaves half the year uncovered.

Do you track your Reporting Rate? A click rate tells you who slipped. A Reporting Rate tells you who’s defending the company.

Would people finish it if it weren’t required? Continuous practice only works if people actually show up for it.

Sources: FBI IC3 2025 Internet Crime Report · Verizon 2026 DBIR & 2025 SMB Snapshot · IBM Cost of a Data Breach 2025 · Microsoft Digital Defense Report 2025 · APWG Q1 2026 · ITRC 2025 Business Impact Report · ConnectWise/Vanson Bourne · SANS 2025 Security Awareness Report · Reinheimer et al. (USENIX SOUPS 2020) · KnowBe4 2026 Benchmarking Report · Hoxhunt 2026 · Deloitte FSI. Full links in the published version.

Keep reading

• Best security awareness training for MSPs — how the platforms behind these numbers compare.
• Best security awareness training for small business — what to buy and what it costs.

Want this handled for your team? Hook Security trains teams with realistic phishing simulations and short, genuinely funny lessons employees actually watch - all on autopilot. See it in a demo.