What the research says

The research points to one conclusion that matters for your job. People will keep clicking phishing emails no matter how much training they get, so fast, accurate triage of reported emails is one of the most important defenses an organization has.

This page summarizes four lines of evidence behind that conclusion. Full citations are on the Tools & References page.

1. Phishing is still one of the most common and costly attacks

The FBI's Internet Crime Complaint Center (IC3) received 191,561 phishing and spoofing complaints in 2025, more than any other crime type. Business email compromise produced 24,768 complaints and about $3.05 billion in reported losses, the second-largest loss category after investment fraud (Federal Bureau of Investigation, 2026).

Verizon's 2026 Data Breach Investigations Report (DBIR), which covers breaches from November 2024 through October 2025, found that a human element was involved in 62% of breaches. Social engineering, phishing, and stolen credentials remain among the most frequent causes (Verizon, 2026).

The threat is also shifting. The 2026 DBIR reports that exploited software vulnerabilities (31% of breaches) have overtaken stolen credentials as the top way attackers get in. It found click rates on mobile devices about 40% higher than on email, as attackers move to texts and phone calls. Attackers also now use generative AI across 15 documented attack techniques, including writing more convincing phishing content (Verizon, 2026).

2. Why people fall for phishing: context matters more than carelessness

NIST researchers developed the Phish Scale, a method for rating how hard a phishing email is to detect. Their key finding: when a phishing email's premise lines up with the recipient's actual work, it is much harder to spot, so click rates should be expected to vary with that difficulty (Steves et al., 2019).

A 2025 study of more than 19,500 employees at UC San Diego Health reached a similar conclusion. Click rates depended heavily on the lure; a fake update to the vacation policy fooled 30.8% of recipients (UC San Diego, 2025).

3. Training alone does not stop clicks

Two of the largest real-world studies question how much awareness training helps. The UC San Diego Health study, an 8-month randomized experiment, found that common anti-phishing training is unlikely to offer significant protection. Embedded training, shown right after an employee clicks a simulated phish, reduced failure rates by only about 2 percentage points (Ho et al., 2025).

Earlier, a 15-month study of more than 14,000 employees at a large company found that embedded training did not make employees more resilient, and may even have made some more susceptible (Lain et al., 2022). The UC San Diego researchers recommend that organizations rely more on technical countermeasures.

4. What does work: employee reporting plus fast analyst response

The same 15-month study tested a “report phishing” button in the email client. Crowdsourced reporting detected new, previously unseen phishing campaigns shortly after they started. The workload of processing reports stayed manageable, and employees kept reporting over the full 15 months without signs of fatigue (Lain et al., 2022).

MITRE ATT&CK lists user training alongside technical controls such as email authentication (SPF, DKIM, and DMARC) and attachment filtering as mitigations for phishing (MITRE, 2026). NIST's incident response guidance stresses improving the efficiency and effectiveness of detection and response (Nelson et al., 2025).

What this means for a new analyst

• Every report is valuable. The first report of a campaign is the early warning for everyone else who received it.
• Speed matters. Triage the report, then search for the same email in other inboxes.
• Thank the reporter, even for false positives. Reporting only works if people keep doing it.
• Judge by evidence (headers, links, the request itself), not by how obvious an email looks.