Security Awareness Training Statistics 2025 [100+ Studies]

Picture this: Your company spends millions on firewalls, encryption, and advanced security software. Then an employee clicks one suspicious link, and everything falls apart. The average data breach costs organizations $4.44 million globally in 2025, with U.S. companies facing costs exceeding $10 million. But before you blame the employee, consider this: the 2025 Verizon Data Breach Investigations Report found that just 8% of employees account for 80% of security incidents. The solution isn't training everyone harder. It's identifying and supporting the right people.

Between 60% and 74% of all successful cyberattacks involve the human element. The 2025 Verizon Data Breach Investigations Report shows 60% of breaches involve human actions such as errors, social engineering, or misuse, while IBM reports 74% involve human factors. These percentages have been declining as organizations improve their training programs, down from 68% in 2024. Not because firewalls failed. Not because hackers found secret backdoors in code. Because someone opened the wrong email, used a weak password, or fell for a convincing scam.​

But the good news is that organizations with comprehensive training programs can reduce employee susceptibility to phishing attacks by up to 86% compared to their initial baseline. Well-designed training programs typically deliver returns of 3 to 7 times their investment, with some organizations reporting returns as high as 300%. The business case isn't just strong. It's compelling.​

This article examines data from over 100 research studies conducted between 2024 and 2025. We'll look at what's actually working, where companies are failing, and how much these mistakes cost. More importantly, we'll explore what you can do about it.

Before we dive into the numbers, let's clarify what we're talking about. Security awareness training means teaching employees how to spot threats, avoid mistakes, and respond when something looks suspicious. Human risk refers to the chance that someone in your company will accidentally (or intentionally) cause a security problem. Think of it as the probability that clicking, sharing, or downloading the wrong thing will lead to trouble.

How Big is the Human Error Problem in Cybersecurity?

What Percentage of Cyber Breaches Are Caused by Human Error?

The numbers tell a sobering story. According to the 2025 Verizon Data Breach Investigations Report, 60% of breaches involved human factors like falling for scams or making errors. IBM's research puts it at 74%. Stanford University's earlier research found that 88% of data breaches happen because of employee mistakes.​

Some older studies reported figures as high as 95%. Research analyzing incidents across 120 countries found that human error played a role in 95% of security problems. However, these studies used different methodologies and definitions of "human error" (some included malicious insiders, others focused only on unintentional mistakes).​

Why the different percentages? Each study uses different methods and definitions. The Verizon 2024 report, for example, revised its methodology to exclude malicious privilege misuse, making year-over-year comparisons challenging. But they all agree on one thing: humans remain the most significant factor in most security problems.​

Has anything changed recently? Yes. In 2023, the human element appeared in 74% of breaches. By 2024, that number dropped to 68%. The 2025 report shows it has declined further to approximately 60%. That's progress, though the absolute number of attacks keeps growing even as the percentage inches down.​

What Types of Human Errors Lead to Security Breaches?

Not all mistakes are equal. Research shows clear patterns:

Phishing and social engineering initiates 30% to 41% of all successful attacks. These are the fake emails and messages designed to trick people into clicking dangerous links or sharing passwords.​

Weak passwords contribute to 43% of attacks that steal login credentials. Reusing the same password across multiple sites makes this worse.​

Accidental insider problems account for 25% of data breaches. These happen when employees unintentionally share sensitive information or misconfigure systems.​

Lost or stolen devices cause 12% of incidents. A laptop left in a coffee shop or a phone stolen from a car can expose company data.​

Healthcare organizations provide a stark example of what these statistics mean in practice. Healthcare continues to face the highest breach costs at $7.42 million per incident in 2025, though this represents a significant decrease from the previous year's $10.93 million. Even with this decline, every mistake in healthcare carries enormous financial weight.​

How Effective Is Security Awareness Training?

Does Security Awareness Training Actually Work?

Yes, but effectiveness varies significantly based on implementation quality.

A 2025 survey found that 78.5% of organizations believe their training works moderately well or better. However, believing something works and proving it works are different things. Recent research has also questioned the impact of traditional one-size-fits-all approaches, finding limited behavior change from generic annual training sessions. This underscores the importance of continuous, personalized, and engaging training programs rather than compliance-focused checkbox exercises.​

For organizations that consistently implement quality training, the results are compelling. KnowBe4's 2025 Phishing by Industry Benchmarking Report analyzed 67.7 million phishing simulations across 14.5 million users from 62,400 organizations worldwide. They found that the global baseline click rate (called the "Phish-prone Percentage") averaged 33.1% before training. After just 90 days of training, this dropped by 40%. After 12 months of ongoing training, organizations achieved an 86% reduction, bringing the click rate down to just 4.1%.​

Organizations running ongoing training programs can reduce employee-caused security incidents by up to 72% within the first year, according to multiple studies.​

The timeline matters. Within the first three months, click rates typically drop by 15% to 20%. After six months, half of trained employees report spotting and reporting real threats on their own. By the one-year mark, well-run programs see substantial reductions in overall security incidents.​

But there's a concerning gap. While 78.5% of organizations think their training works, 45% of employees receive no security training at all. Only 52% of companies conduct phishing training despite phishing being the most common attack method.​

What ROI Can Organizations Expect from Training Programs?

Let's talk money. Research shows that well-designed training programs typically deliver returns of 3 to 7 times their investment. Some organizations report returns as high as 300%, meaning for every dollar spent on training, they gain $4 in value.​

The math works like this: The average data breach costs $4.44 million in 2025. Training costs range from $100 to $200 per employee annually. For a company with 500 employees, that's $50,000 to $100,000 per year.​

Organizations with trained employees can reduce their breach probability significantly within 12 months. If your training prevents just one breach every few years, you save millions while spending hundreds of thousands. That's a substantial return on investment.​

Companies also get discounts on cyber insurance when they prove they train employees regularly. These discounts can reach 20%, adding up over time.​

Organizations using platforms that employ risk-based approaches see even better returns. Instead of training everyone the same way, security teams can focus resources on the people who need it most. This targeted approach means every training dollar works harder. Brightside AI exemplifies this approach by scanning each employee's digital footprint first, identifying who faces the highest risk based on exposed data, compromised passwords, and public information that attackers could exploit.​

What Are the Biggest Gaps in Current Training Programs?

How Many Employees Receive No Security Training?

A shocking 45% of employees get zero security training from their employers. None. Not even a basic "don't click suspicious links" orientation.​

The gaps get wider when you look at specific training types:

Only 52% of organizations teach employees about phishing. Just 30% provide ransomware training. A mere 25% cover social engineering tactics. And only 7.5% adapt their training based on how individual employees perform on tests.​

Geography matters too. North America leads with 38% of employees receiving regular training. Europe follows at 32%. Asia-Pacific lags at 21%.​

Small businesses struggle the most. In the UK, 2 million small companies provide no cybersecurity training despite 42% experiencing attacks in the past year. These organizations often lack dedicated IT staff or the budget for comprehensive programs.​

Why Do Training Programs Fail to Engage Employees?

When programs do exist, they often fail because of engagement problems. A 2025 survey from Infrascale found that 77% of security leaders cite lack of accountability as the biggest barrier to employee engagement. When no one is clearly responsible for acting on training, it often becomes a box-ticking exercise.​

Employees in surveys identified these specific issues:

Boring content tops the list at 30%. Generic, dry presentations fail to hold attention. Nobody wants to read 50 slides about password policies.​

Not frequent enough came in at 27%. Annual training sessions don't stick. People forget within weeks.​

Too generic was cited by 24%. One-size-fits-all programs don't address the specific threats different employees face.​

Too technical frustrated 22%. Security jargon and complex technical explanations lose non-technical staff.​

About 21.5% of employees rate their company's training as barely effective or completely ineffective. Another 30% find it only slightly engaging.​

Modern platforms address these engagement problems through different approaches. Gamification increases engagement by 60%. Interactive formats retain information 2.3 times better than traditional presentations.​

Brightside AI tackles the engagement problem directly with Brighty, an AI instructor who explains security concepts through conversational chat. Instead of reading boring slides, employees interact with an AI that adapts explanations to their level and answers questions in plain language. The platform includes mini-games and challenges that make learning feel less like mandatory training and more like skill-building.​

Which Employees Are Most Vulnerable to Cyber Attacks?

Not everyone faces the same level of risk, and the 2025 Verizon DBIR revealed a critical insight: just 8% of employees account for 80% of security incidents. This finding validates the importance of risk-based training approaches.​

Age makes a significant difference. Research from Tessian found that employees aged 18 to 24 click on phishing emails five times more often than employees over 65. Specifically, 39% of young workers click dangerous links compared to just 8% of older employees. However, older workers (55+) fall for text message scams 33% of the time, while younger workers only fall for them 24% of the time.​

Department matters too. Marketing employees show 41% susceptibility to phishing. Sales comes in at 35%. Operations shows the lowest vulnerability at just 12%. Finance sits in the middle at 21%.​

Why such big differences? Marketing teams often engage with outside contacts and click on unfamiliar links as part of their job. Operations teams typically work with internal systems and established processes.

Executives face different risks. They're not necessarily more likely to fall for attacks, but they're much more likely to be targeted. In 2024, 62% of C-suite executives received targeted spear phishing attempts. Attackers know that compromising an executive's account gives access to sensitive information and the authority to authorize payments.​

Understanding these patterns helps security teams focus their efforts. Brightside AI automates this process by scanning each employee's publicly available information to calculate individual vulnerability scores. The system identifies who has the most exposed data, whose passwords appeared in breaches, and who faces the highest risk based on their role and digital footprint. Security teams can then provide extra support to the high-risk employees who represent the majority of the risk.​

What Are the Latest Phishing and Social Engineering Statistics?

How Common Are Phishing Attacks in 2025?

Phishing remains the most popular attack method. About 3.4 billion phishing emails go out every single day worldwide. That's not a typo. Billions. Daily.​

Employees face constant phishing threats, with billions of phishing emails sent globally each day. While many are caught by email filters, targeted spear phishing attempts regularly reach employee inboxes.​

The success rates vary by sophistication. Generic mass phishing emails fool 30% to 35% of untrained employees. That drops to 12% to 15% after basic training. Better, but still concerning.​

Targeted spear phishing works much better. These personalized attacks trick 50% to 60% of untrained employees. Even with training, 20% to 25% still fall for them.​

But the real concern is AI-generated spear phishing. Research from late 2024 found that AI-generated spear phishing campaigns achieved a 54% success rate in controlled testing, matching the effectiveness of attacks crafted by human experts. Separate research tracking AI phishing evolution shows that AI-powered attacks improved from being 31% less effective than human-crafted emails in 2023 to 24% more effective by March 2025, demonstrating rapid advancement in AI-powered threat capabilities.​

What About Voice Phishing and Deepfake Attacks?

Email isn't the only threat anymore. Voice phishing attacks have surged dramatically, with some research showing increases of over 400% year-over-year. More than half of organizations (54%) experienced vishing attempts in 2024.​

The average loss from a successful voice phishing attack? $125,000. Yet only 18% of organizations train employees to recognize phone scams.​

Deepfakes represent an even newer threat. These AI-generated fake videos and audio recordings increased 3,000% between 2023 and 2025, though this growth started from a relatively low baseline. In one notable case, a Hong Kong company lost $25 million after an employee joined a video call with what appeared to be the CFO and other executives. All of them were deepfakes.​

Testing reveals the scope of the problem. When played deepfake audio in blind tests, 90% of organizations couldn't tell the difference. Less than 10% of training programs address deepfakes at all.​

Modern attacks come through phone calls, text messages, video conferences, and even QR codes. Brightside AI provides training across all these channels: email phishing, voice phishing, and deepfake detection. Employees learn to recognize suspicious patterns regardless of how attackers make contact.​

The platform uses realistic simulations for each channel. Employees might receive a fake phishing email one week, a simulated vishing call the next, and training on spotting deepfake audio the week after. This comprehensive coverage ensures they're prepared for real-world attack diversity.

What Should Organizations Do Next?

How Can Security Leaders Take Action on These Statistics?

The data makes the business case clear. Human error contributes to 60% to 74% of breaches, but quality training can reduce phishing susceptibility by up to 86% while delivering 3-7x returns on investment. The question isn't whether to invest in training. It's how to implement programs that actually work.​

Start by assessing your current situation. What percentage of your employees receive security training? How often does that training happen? Annual sessions aren't enough. Research shows that organizations with continuous training combined with regular simulations achieve dramatically better results than annual programs.​

Next, figure out who faces the highest risk. The 2025 Verizon DBIR finding that 8% of employees account for 80% of incidents means that not everyone needs the same level of training. Some employees have extensive digital footprints with exposed personal information. Others work in departments that attackers target more frequently. Focus your initial efforts on the high-risk employees who likely represent the majority of your vulnerability.​

This is where traditional approaches fall short. Most programs assume all employees face equal risk and need identical training. They send the same generic content to everyone and hope it sticks.

Brightside AI takes a different approach. The platform uses OSINT (Open Source Intelligence) technology to scan the publicly available information about each employee. It finds:

• Email addresses and phone numbers exposed online

• Passwords that appeared in past data breaches

• Professional details on LinkedIn that attackers could exploit

• Social media profiles and connections

• Online accounts and services

• Geographic data that could be used in targeted attacks

Based on this scan, Brightside generates a vulnerability score for each person. Security teams can immediately see who needs the most help. The marketing coordinator whose password appeared in three breaches and who shares personal details on social media needs more attention than the operations manager with minimal online presence.​

This targeting multiplies your training effectiveness. Instead of spending equal resources on everyone, you invest more time and money on the people who need it most, directly addressing the finding that a small percentage of employees drive the majority of security incidents.

What Type of Training Actually Changes Behavior?

Generic training doesn't work because it doesn't reflect reality. Most programs show templated examples: "This is what a phishing email looks like. Don't click these types of links."

But attackers don't send templated emails. They research targets and craft messages specifically designed to fool them. They mention real colleagues, reference actual projects, and use information gathered from LinkedIn and social media.

Effective training needs to mirror these real threats. Brightside generates personalized phishing simulations using the same publicly available information attackers would find. If an employee's LinkedIn profile shows they work in vendor management, they might receive a fake invoice from a supplier that exists in their industry. If someone posts about their hobbies on social media, they might get a phishing email about that interest.​

This approach addresses a critical challenge: sophisticated AI-generated spear phishing using OSINT data succeeds approximately 54% of the time. The only way to prepare people against these sophisticated attacks is to simulate them realistically.​

Training also needs to happen frequently and in small doses. The brain doesn't retain information from one annual 90-minute session. Micro-learning delivers short lessons (5 to 10 minutes) weekly or even daily. This spacing helps information stick.​

Engagement matters enormously. Dry presentations and boring videos produce poor results. Gamification elements like points, badges, and friendly competition increase engagement by 60%. Brightside incorporates these elements through its AI instructor Brighty, who guides employees through interactive challenges and mini-games rather than passive reading.

How Do You Measure If Training Is Working?

You can't improve what you don't measure. Track these core metrics:

Phish-prone percentage shows what portion of employees click on simulated phishing tests. Start with a baseline before training begins, then track monthly improvement. KnowBe4's 2025 data shows the global baseline at 33.1%, with strong programs achieving below 5% within a year.​

Reporting rate measures how many employees report suspicious emails rather than just deleting them or ignoring them. Strong programs see 60% or higher reporting rates.​

Time to report tracks how quickly employees flag threats. Faster reporting means less time for attackers to operate. Aim for under five minutes median time from receiving a suspicious message to reporting it.​

Repeat offender rate identifies employees who consistently fail simulations despite training. These individuals need extra support or different approaches. This percentage should stay below 2%.​

Compare your performance to industry benchmarks. Based on data from over 10,000 global simulations in 2025, average organizations show click rates of 8% to 14% with reporting rates of 30% to 45%. Excellent programs achieve click rates under 5% with over 70% reporting rates.​

Improvement happens gradually. Expect 30% to 40% improvement in the first three months. By six months, you should see 50% to 60% improvement. At the one-year mark, well-run programs achieve 70% to 86% improvement from baseline.​

What Questions Should You Ask Training Vendors?

Not all security awareness platforms deliver the same results. When evaluating options, ask these questions:

Can you assess individual employee vulnerability before training begins? Platforms that start with vulnerability assessment target resources more effectively than one-size-fits-all approaches.

Do your simulations use realistic information about our employees? Generic templates don't prepare people for the personalized attacks they'll actually face.

What attack channels do you cover? Email-only training leaves massive gaps. Look for platforms that include voice phishing and deepfake education.

How do you keep training engaging? Ask about completion rates and engagement metrics from current customers. Industry data shows that ideal completion rates should exceed 90%, and high abandonment suggests boring content.​

What metrics do you track and report? You need clear data showing improvement over time, not just completion certificates.

How quickly can we deploy across our organization? Implementation shouldn't take months. Modern platforms launch within days or weeks.

The market offers dozens of options. Traditional platforms like KnowBe4 and Proofpoint provide comprehensive feature sets and established track records. Newer platforms like Hoxhunt and SoSafe focus on engagement and behavioral psychology.

Brightside AI differentiates itself by combining OSINT-powered vulnerability assessment with multi-channel training coverage. The platform scans employee digital footprints, calculates individual risk scores, generates personalized simulations using real exposed data, and covers email, voice, and deepfake threats in one integrated system.​