Skip to main content
Back to Blog

Security Awareness Training Statistics 2026: 25 Verified Numbers (and 3 We Refuse to Cite)

Security Awareness Training Statistics 2026: 25 Verified Numbers (and 3 We Refuse to Cite)

Updated August 2026 · Every statistic below links to its primary source. Vendor-published research is labeled as such.

The short version: 62% of breaches still involve the human element (Verizon DBIR 2026). AI-written phishing gets 4.5x more clicks than human-written phishing (Microsoft, 2025). And training works — phishing susceptibility drops roughly 79% after 12 months of continuous training (KnowBe4 benchmark data) — but the effect fades within about 6 months without reinforcement (peer-reviewed, USENIX). That's the case for security awareness training that actually runs, continuously, in 25 numbers.

The headline numbers

  1. 62% of breaches involved the human element — Verizon, 2026 Data Breach Investigations Report. (60% in the 2025 edition — stable, stubborn, and the reason this category exists.)
  2. $20.9 billion in cybercrime losses were reported to the FBI in 2025 across 1,008,597 complaints — and phishing/spoofing was the #1 most-reported crime (191,561 complaints). — FBI IC3, 2025 Internet Crime Report.
  3. People are 4.5x more likely to click an AI-generated phishing email — 54% click-through vs. 12% for manually written lures. — Microsoft Digital Defense Report 2025.
  4. The average U.S. data breach now costs a record $10.22 million (global average: $4.44M). — IBM Cost of a Data Breach Report 2025.

Small business risk

  1. Ransomware was present in 88% of breaches at small businesses — versus 39% at large organizations. — Verizon 2025 DBIR SMB Snapshot.
  2. 81% of small businesses experienced a security or data breach in 2025. — Identity Theft Resource Center, 2025 Business Impact Report.
  3. 62.5% of breached small businesses took a financial hit over $250,000 — and more than a third of those exceeded $500,000. — ITRC 2025.
  4. AI-powered attacks were a root cause in over 40% of cyber events hitting small businesses in 2025. — ITRC 2025.
  5. 94% of SMBs have experienced at least one cyberattack (up from 64% in 2019), and 78% fear a severe attack could put them out of business. — ConnectWise State of SMB Cybersecurity (Vanson Bourne survey).
  6. 38.3% of small business leaders raised prices to cover cyber-incident costs — a hidden "cyber tax" passed to customers. — ITRC 2025.

Does training actually work?

  1. Untrained employees fail phishing simulations at a 33.2% baseline rate — falling to 4.2% after 12 months of continuous training, a 79% reduction. — KnowBe4 2026 Phishing by Industry Benchmarking Report (vendor research: 42M simulations, 64,000 organizations).
  2. The first 90 days of training alone cut susceptibility ~40%. — KnowBe4 2026 (vendor research).
  3. Training effects fade back toward baseline in roughly 6 months — peer-reviewed field research recommends reinforcement at least every 6 months, and found video-based and interactive refreshers worked best. — Reinheimer et al., USENIX SOUPS 2020. (This is the peer-reviewed heart of the argument for continuous, engaging programs over annual compliance training.)
  4. Continuous behavior-change training cut malicious link clicks 87% in 6 months and drove 6x more threat reporting. — Hoxhunt Phishing Trends Report 2026 (vendor research).
  5. Trained employees become detectors, not just liabilities: 64% report at least one REAL phishing threat within 12 months of continuous training. — Hoxhunt 2026 (vendor research).
  6. It takes at least 2.8 dedicated full-time staff to meaningfully change security behavior — one big reason SMBs hand awareness programs to MSPs or managed providers. — SANS 2025 Security Awareness Report (2,700+ practitioners surveyed).

Phishing & the threat landscape

  1. 971,181 phishing attacks were observed in Q1 2026 alone — up 13.8% quarter over quarter. — APWG Phishing Activity Trends Report.
  2. Business email compromise cost $3.05 billion across 24,768 complaints in 2025. — FBI IC3.
  3. Mobile social engineering attacks succeed 40% more often than traditional email phishing. — Verizon DBIR 2026.
  4. 48% of breaches involved a third party — up 60% year over year. — Verizon DBIR 2026.
  5. 82.6% of analyzed phishing emails showed some use of AI. — KnowBe4 Threat Labs, 2025 (vendor research).
  6. 16% of data breaches involved attackers using AI, most often for phishing or deepfake impersonation. — IBM 2025.
  7. A single deepfake video call cost engineering firm Arup $25 million — an employee wired the money after a video conference with an AI-generated "CFO." — Arup-confirmed, reported May 2024.
  8. Deepfake-driven fraud losses in the U.S. are projected to reach $40 billion by 2027. — Deloitte Center for Financial Services.
  9. Employee use of unapproved "shadow AI" tools tripled in a year — from 15% to 45%. — Verizon DBIR 2026.

Three famous statistics we refuse to cite

You've seen these everywhere. We won't use them, and here's why:

  • "60% of small businesses close within 6 months of a cyberattack." The organization it's attributed to (the National Cybersecurity Alliance) publicly disavowed it years ago. No underlying study exists. Use the ConnectWise sentiment finding instead: 78% of SMBs fear a severe attack could close them — that one's real.
  • "43% of cyberattacks target small businesses." Traces to a ~2015 spear-phishing figure recycled for a decade without a current primary source. Verizon's SMB Snapshot gives you real, current numbers.
  • "95% of breaches are caused by human error." A garbled citation chain. The defensible, precisely-defined figure is Verizon's human-element number: 62%.

If a vendor leads with any of these three, ask what else they didn't check.

What the numbers add up to

Phishing is the front door, AI just made every lure better-written, and small businesses carry a disproportionate share of the damage. Training demonstrably works — but only as a continuous program with content people actually watch, refreshed at least every six months. That's the program design Hook Security runs on: psychology-based, humor-driven micro-learning with managed phishing simulations — [see how it works].

Sources: FBI IC3 2025 Internet Crime Report · Verizon 2026 DBIR & 2025 SMB Snapshot · IBM Cost of a Data Breach 2025 · Microsoft Digital Defense Report 2025 · APWG Q1 2026 · ITRC 2025 Business Impact Report · ConnectWise/Vanson Bourne · SANS 2025 Security Awareness Report · Reinheimer et al. (USENIX SOUPS 2020) · KnowBe4 2026 Benchmarking Report · Hoxhunt 2026 · Deloitte FSI. Full links in the published version.

Ready to Strengthen Your Security Culture?

See how Hook Security can help protect your organization.

Get a DemoLearn More