Search
Free Trial

Hongke's latest articles

HongKe

Hongke Solutions] Employees are the biggest security asset: KnowBe4 helps organizations avoid human risks

Phishing attacks are evolving at an unprecedented rate, and KnowBe4, the world's largest security awareness training platform, has been tracking phishing trends for a long time through the 14.5 million users, 62,400 organizations and 67.7 million simulated fishing tests The data provides companies with the most authoritative Phish-Prone Percentage (PPP) and risk insights.

This year's report shows that the global average failure rate of first tests is as high as 33.1%The breakdown by industry shows that medical, insurance and retail industries are the most vulnerable to attacks. Meanwhile, AI-generated phishing emails and spoofed emails from internal accounts have become more insidious, posing a more serious challenge to traditional technical defense.

For companies, insufficient staff development, increased cross-border factors and lack of localized fishing simulations further increase the risks. The challenge for companies is not only technical, but also about employee behavior and safety culture. Getting to grips with key data and trends is the first step in developing a training strategy.

Core Data Insights

Comparison of Global PPP and Industry

In the first stage, before any SAT testing, the baseline phishing vulnerability rate (PPP) for global businesses was 33.1%In other words, one in three employees is vulnerable to phishing emails and social engineering attacks.

  • Global Data PPP: 33.1%, with about one-third of the workforce vulnerable.

Digging deeper, we found that more than half of the industries (10 out of 19) have PPP First Test averages above this baseline. For organizations of all sizes, the following industries are the most at risk:

  • Industry Comparison (First Test Failure Rate)::
  • Medical and Health Care: 41.9%
  • Insurance: 39.2%
  • Retail & Wholesale: 36.5%

The data shows that employees in highly sensitive information industries and customer-facing interactive business operations are more likely to be targeted, with significantly higher than average failure rates at first detection. Only five industries had PPPs below 301 TP3T, and even then, more than a quarter of employees were vulnerable to phishing attacks: Transportation (29.91 TP3T), Business Services (29.61 TP3T), Consumer Services (29.51 TP3T), Legal (28.51 TP3T), and Government (28.21 TP3T).

The bigger the business, the greater the risk

On average, having More than 10,000 employees The company's PPP is as high as 40.5%Ownership 1,000-9,999 staff The corporate PPP for 33.7%Ownership 250-999 staff The corporate PPP for 28.7%; in contrast, only 1-250 staff The corporate PPP for 24.6%The

This phenomenon is illustrated by the fact that the more people there are, the more emails there are, and the more fingers there are to click on the links. And it's harder to raise a collective consciousness among more people. The risk profile varies by industry and organization size, but collectively, the greatest risks are concentrated in the larger enterprises.

Phishing Risks Likely to Decline and Remain Low

The good news is that after just 90 Days of Best Practices TrainingThe risk of phishing can be significantly reduced across all industries. The global average click-through rate per five employees (19.81 TP3T) can be reduced by Over 40%The

The situation continues to improve:12 months laterAverage PPP declines 86% to 4.1%This downward trend will continue. With continued training, the average PPP could be reduced to $4.5 billion in two years' time. 3.7%In three years' time, it could even be reduced to 2.6%This trend of decline has been observed in all sectors. This downward trend has been observed in all sectors.

Corporate Training Effectiveness Analysis

Enterprise Size Number of workers Baseline PPP (First Test Failure Rate) Average improvement rate (SAT one year later) High Risk Sector (Baseline PPP ≥30%) Industries with the Most Outstanding Training Effectiveness and Data
Large Enterprises 1,000-10,000 33.7% 87% Healthcare & Pharmaceuticals (41.1%), Banking (39.5%), Financial Services (38.4%), Energy & Utilities (37.2%) Medical & Pharmaceuticals, Hospitality, Legal: 91% improvement rate; Legal SAT lowest click-through rate after one year 3.1%
Medium-sized Enterprises 250-999 28.7% 86% Nonprofit (31.7%), Insurance (31.6%), Healthcare & Pharmaceuticals (31.4%), Retail (31.5%), Banking (30.4%), Consumer Services (30.1%) Banking click rate down 91.8% (to 2.5%), Transportation 89%, Energy & Utilities 88%, Manufacturing 87%, Transportation 87%, Financial Services 87%
Small Business 1-249 24.6% 85% Nonprofit (27.5%), Insurance (26.9%), Healthcare & Pharmaceuticals (26.6%), Retail (26.5%) Banking hit rate down to 21 TP3T (down 901 TP3T); Energy & Utilities, Transportation, Construction, Education all at 871 TP3T

Form Instructions:

  • The higher the baseline PPPThe more risky it is to click on a phishing link in the first test, the more risky it is to click on a phishing link in the first test.
  • Average Improvement RateThis is the overall effect of the 12-month training.
  • High Risk IndustriesIndicates sectors with higher baseline PPP.
  • Industry with the most outstanding training effectShows the data with the greatest decrease in risk or the lowest hit rate after SAT.

While large enterprises are rich in training resources and can make more significant improvements, small and medium-sized enterprises rely on tools and automation templates to make up for the lack of training coverage.

Asia Pacific Data

  • First Test Failure Rate: 28.6%
  • After 12 months of continuous training: down to 5.2%
  • Training Effect: Decrease in click-through rate 81.8%

The Asia-Pacific data confirms the effectiveness of continuous training and phishing simulations; it also reminds companies not to overlook regional differences and localization needs.

Phishing Attack Trends

  • Total Fishing Email Growth 17.3%
  • Overview of Microsoft's Native Defenses and Secure Mail Gateway Attack Growth 47%
  • 82.6% Fishing Mail Use AI Content Generation
  • Increasingly stealthy attacks, including fake internal emails, imitation of high-level approvals or financial audit requests

AI interventions have made phishing emails more realistic and difficult to recognize even for trained security professionals. In the next two years, some traditional detection mechanisms may become ineffective.

Solution Direction: KnowBe4 Value Realization

Continuous Training and Simulated Fishing

  • Through a 12-month training program, the Global PPP was organized by 33% down to 6%
  • Asia Pacific PPP by 28.6% Decreased to 5.2%
  • Significantly reduce the risk of employees clicking on malicious links and improve the overall level of security protection.

Multi-language and automation template update

  • Supports cross-border training in multiple languages, covering multiple forms of expression and multiple security scenarios.
  • Automatically generates the latest fishing scene templates to quickly cover emerging attack techniques.

AI Scene Generation

  • Generate more realistic and targeted fishing simulations
  • Enhancement of staff identification skills to bring training closer to real-life attack scenarios

KnowBe4 is more than just "training"!

  • Coverage of 35+ languages with focus on compliance, attack identification and risk response
  • Built-in AI fishing simulation system to automatically generate customized test scenarios
  • Strong behavioral analysis mechanism to achieve personalized feedback and retraining
  • Fully automated training process, greatly simplifying the management process
  • Seamless integration with HRIS, security gateways, etc.
Go to KnowBe4 Product Page

Other Articles
Hongke Dry Goods

[Hongke Solutions] ArangoDB Contextual Data Platform: Key Architecture for Next-Generation Network Asset Management (CAM/CMDB)

An in-depth analysis of how enterprises can transition from single LLM API calls to autonomous agentic systems. This article compiles real-world examples of AI agent deployments in production environments across six major industries, including retail and finance, and breaks down the underlying infrastructure logic—such as high concurrency, cross-interaction memory (Memory Infrastructure), and distributed state persistence.

Read more
HongKeTechnology October 16, 2026
虹科 MSR175plus 衝擊與環境數據記錄器外觀圖：黃色堅固外殼配有 GNSS 定位功能、三軸加速度（X/Y/Z）以及溫度、濕度、氣壓、光照與傾斜感測器圖示，專用於運輸與物流監測。
Hongke Dry Goods

[Hongke Case Study] TSMC Selects MSR Shock and Vibration Data Loggers

How Can You Prevent Vibration Damage During International Transport of Semiconductor Wafers and Photomasks? We Reveal the Key Reasons TSMC Chose Hongke’s MSR175Plus Shock and Vibration Data Logger! The product features long battery life and large-capacity memory, enabling precise recording of temperature, humidity, pressure, and multi-axis acceleration during long-distance transport. In an exclusive interview, a TSMC engineer shares how the company converts vibration into quantifiable data and establishes rigorous standards to effectively reduce the risk of damage and significantly improve the success rate of international shipments!

Read more
HongKeTechnology October 14, 2026
PCB 電路板組裝視覺檢測與測量示意圖：陣列排列的印刷電路板（PCBA）在藍光光源下展示晶片、元件與金屬焊盤細節，適用於 SMT 表面貼裝自動光學檢測（AOI）與品質管控。
Hongke Dry Goods

[Hongke Solutions] How Can AI-Powered Industrial Vision Inspection Overcome Quality Bottlenecks? A Comprehensive Analysis of Multi-Camera PTP Synchronization and Defect Detection

An In-Depth Analysis of AI Industrial Vision Inspection Technology! Explore how high-resolution industrial cameras, AI deep learning algorithms, and IEEE 1588 PTP microsecond-level multi-camera time synchronization precisely overcome bottlenecks in PCB component measurement and lithium-ion battery defect detection, and SMT Automated Optical Inspection (AOI), thereby improving production line yield!

Read more
HongKeTechnology October 12, 2026
close menu icon

Contact Hongke to help you solve your problems.

Let's have a chat