Resources
Learn how to drive down human risk
Research from 4.6 million simulations, the rollout playbooks our customers actually use, and the technical detail your mail team will ask for on the first call.
- 28-page
- 2026 benchmark report
- 6
- frameworks mapped
- Free
- phishing test, 100 people
Featured
The 2026 human risk benchmark
Four point six million simulations across 1,200 organisations, broken down by industry, channel and organisation size — including how long a phish-prone rate actually takes to fall, and which cohorts never move without targeted intervention.
- Baseline rates by industry, with sample sizes
- How SMS and voice results differ from email
- What separates programmes that plateau from those that don't
28 pages · 18 minute read · no gate on the summary
The headline finding
The curve is steep, then it isn't
Most of the first-quarter improvement is people who had simply never been tested. The remaining cohort is the one that decides whether a programme was worth running.
Finding 01
Ninety days gets you two-thirds of the way
Across the dataset, baseline phish-prone rates fell from 33.2% to 20.1% within ninety days — then took a further nine months to reach 4.2%. Programmes that stopped at the ninety-day win reverted within two quarters.
- 33.2% → 20.1% in 90 days
- 20.1% → 4.2% over the following 9 months
- Reversion within 2 quarters if campaigns stop
Start here
If you only read three things
Library
Go deeper
Everything else — research, guides, templates and one free tool.
For admins
Where the technical detail lives
The four things your mail team, your IdP admin and your auditor each ask about.
Run a free phishing test
One campaign, up to 100 people, results and a provisional grade in about twenty minutes. No credit card and no commitment.