One in three of your employees will click on a phishing email. Not eventually — this year, on average, across every industry measured. The global baseline click rate going into 2026 sits at 33.2% (KnowBe4, 2026 Phishing Industry Benchmarking Report). In healthcare, it's over 42%. That's not a training failure on your part. It's the actual starting point for every organization that hasn't built human risk management into how it runs security — and most haven't.
Training once a year is worse than doing nothing, in one specific way
It creates the illusion that the problem is handled. The data says otherwise. Organizations that run continuous phishing simulation and adaptive training see click rates fall by 40% within 90 days — but the real result doesn't show up until later. At 12 months of sustained training, click rates drop by 87%, down to roughly 4%. The 90-day mark isn't the finish line; most of the behavioral change happens in the nine months after it (KnowBe4, 2026). A single annual training session captures none of that curve. It's a compliance checkbox, not a risk reduction.
AI didn't create this problem — it made it faster
Phishing has always relied on a plausible pretext. What's changed is the cost of producing one. Generative AI now lets attackers produce highly personalized, convincingly local lures at scale — a fluent, context-aware email tailored to your industry, your vendor relationships, even your company's recent news, generated in seconds instead of hand-crafted for a high-value target. Generic, sloppily-translated phishing emails were never the real threat. The version that references a real invoice number is.
This is exactly why generic annual training stops working the moment AI-generated phishing becomes common: it trains people to spot the old tells — bad grammar, obvious spoofed addresses — that AI-generated phishing no longer has.
"We're too small to be a target" is the most expensive assumption in this list
Smaller companies — under 250 employees — actually start with a lower baseline click rate than large enterprises (24.7% versus 39.5%), which sounds reassuring until you realize what it actually means: smaller organizations usually have fewer layers between "an employee clicks something" and "money leaves the company." Fewer approval steps, fewer people reviewing a payment request, less redundancy. A quarter of your team clicking on the wrong email is not a small number when there's no second check behind them.
The regulatory floor just moved, and it caught a lot of companies off guard
Germany's NIS2 Implementation Law took effect on 6 December 2025, expanding the number of regulated organizations from roughly 4,500 to around 30,000 — a company now falls in scope if it operates in one of 18 designated sectors and either employs 50+ people or exceeds €10 million in annual turnover or balance sheet total. That's a very different bar than the old "critical infrastructure only" framing. In-scope entities had to register with the BSI by 6 March 2026, and management bodies are now required to complete recurring cybersecurity risk training at least every three years — a legal obligation, not a best practice suggestion.
If your business fits that size threshold and you haven't checked whether you're now in scope, that's worth five minutes today. And even if you're not: NIS2's training requirement is a reasonable preview of where regulatory expectations are heading generally, not just for the 30,000 companies technically covered.
What continuous human risk management actually looks like
Not a slide deck once a year. A running program: simulated phishing campaigns that adapt to how your team actually responds, micro-learning targeted at each person's specific knowledge gaps rather than a one-size-fits-all course, a single human risk score you can track month over month instead of a training-completion checkbox, and policy acknowledgment you can actually produce during an audit instead of reconstructing from memory.
That's the shape of the numbers above, translated into a program: measure where the risk actually is, close it continuously, and be able to show the trend line — not just the certificate.
Sources: KnowBe4 2026 Phishing Industry Benchmarking Report; Germany NIS2 Implementation Law (in force 6 December 2025) coverage via Freshfields.