The best-funded companies open the most phishing attachments

Executive summary: A phishing simulation benchmark covering 13.9 million simulated messages found that only about 10% of recipients reported phishing, while many clicked links or submitted credentials—resulting in approximately 250,000 credential submissions in the study. The report emphasizes the rise of phishing-as-a-service, persistent social-engineering TTPs that bypass MFA and technical controls, and variable workforce susceptibility by industry, language, and company size; it recommends keeping technical controls updated and conducting regular user testing.