Report Emphasizes Importance of Building a Security Culture
While security teams have invested heavily in e-mail protection, endpoint security, and identity controls, new research from Fortra suggests one challenge remains difficult to solve: users.
The company's 2025 Phishing Simulation Benchmark Report analyzed 14 million simulated phishing recipients across more than 7,500 campaigns to examine employees' responses to phishing attempts.
The findings highlight a persistent challenge for security teams: Attackers continue to target people because compromised accounts can provide direct access to enterprise environments.
Across the simulations analyzed, Fortra found a 5.42% click rate and a 1.99% password submission rate, showing that convincing phishing attempts can still persuade users to interact with malicious content.
The report also found that phishing reporting remains a challenge. Only 10.5% of users reported simulated phishing e-mails, meaning many potential threats could go unnoticed without additional security controls.
The findings reinforce why identity security has become central to modern defense strategies.
As organizations move more applications and data into cloud environments, stolen credentials can provide attackers with a path into sensitive systems without requiring malware or traditional exploits.
Multifactor authentication, conditional access policies, user training and identity monitoring can all help reduce risk, but Fortra's research suggests technology alone is not enough.
The report argues that phishing defense requires organizations to treat employees as part of the security perimeter — not simply as potential victims.
"The modern phishing ecosystem is no longer defined by isolated scams, but by rapidly evolving criminal platforms that continuously adapt to defensive improvements," Fortra said.
The challenge is clear: Blocking phishing attacks requires more than stronger e-mail filters. It requires building a security culture where users recognize threats, report suspicious activity and become another layer of defense.
For the full report, visit the Fortra site.