Statistics from the Kaspersky Automated Security Awareness Platform (KASAP) phishing simulator demonstrate that emotionally charged and topical email lures remain the hardest for employees to identify as fake. High click rates for even common phishing tricks underscore the pressing need for ongoing cyber awareness training in organizations of all sizes.
In 2026, phishing is the most prevalent cyber incident for businesses at any stage of growth, also ranking top amongst incidents leading to damaging business consequences. Human-targeted attacks are becoming more sophisticated, faster and broader in scope, moving to multi-stage campaigns now heightened by AI-driven techniques. To help businesses counter these risks, Kaspersky is launching new KASAP tiers designed to bring scalable cyber-defense training to organizations of all sizes while sharing insights into today's top phishing triggers.
To identify the most convincing and therefore the most dangerous phishing patterns, Kaspersky analyzed anonymized voluntary provided data from its Phishing Simulator[1]. Available either within each KASAP tier or as a standalone solution for Managed Service Providers (MSPs), this tool allows administrators to safely test employee vigilance by launching realistic, yet unannounced phishing simulations. A high click rate among users clearly highlights what specific cybersecurity training is required.
Recent multiple phishing simulations show that employees most easily mistake malicious emails on these five topics for legitimate ones:
Tech & AI-themed templates, such as "Introducing next-generation artificial intelligence", appeared to be the most convincing and generated a 45% click rate among test recipients.
Healthcare & Insurance lures tricked an average of 28% of the audience. Notably, emails regarding a sanitary inspection report reached a staggering 92% click rate.
Screenshot from KASAP phishing simulator: Your insurance company has rejected your claim
IT Policies and Compliance-centered emails also often bypass employee vigilance, driving clicks from 26% of employees. For instance, a certain simulation requiring a request for approval tricked nearly half of all recipients (48%).
Emails covering Gifts, Promotions & Tickets seemed trustworthy to 24% of the audience. Templates tied to ongoing major events, such as the FIFA-themed "Wear the national team jersey — win prizes!" campaign, demonstrate higher trust levels, capturing an 66% click rate.
Screenshot from KASAP phishing simulator: A gift for you!
HR & Corporate Communications mimicking phishinglured 22% of employees. Especially dangerous were emails raising sensitive and high-interest internal topics, such as internal surveys on company operations or notifications regarding a mandatory dress code.
“People naturally respond to sensitive and highly contextual emails, especially when phishing mimics their exact workflow or local specifics. Knowing this, cybercriminals make their traps more personalized and this trend is set to accelerate with the rise of generative AI” - comments Svetlana Kalashnikova, Security Awareness expert at Kaspersky. “Fortunately, proper cultivation of cyber vigilance demonstrates measurable risk reduction: regular training and attack simulations drastically reduce phishing susceptibility rates from 60% to a mere 5–7%, according to KASAP effectiveness analytics. To protect people and businesses from human-targeting threats, we strongly recommend that organizations implement ongoing cybersecurity awareness program for all employees.”
New plans of Kaspersky Automated Security Awareness Platform make its recognized training, backed by nearly 30 years of Kaspersky’s cybersecurity expertise, accessible to various budgets and needs. All three distinct options feature integrated phishing simulations and help organizations reinforce secure behavior and reduce human-driven cyber risk.
Designed for small and medium organizations, KASAP Essential builds core cybersecurity skills among employees and maintains compliance via user-friendly, easy-to-manage training. KASAP Proactiveprovides continuous, proactive training and measurement, and is the best choice for companies with 1,000+ employees. For enterprises with a mature security culture and organizations in regulated industries, KASAP Advanced provides tools to build customized security awareness programs – on-premises or in the cloud.
To get a free KASAP trial and evaluate the current level of an organization's cybersecurity culture, please visit: https://www.k-asap.com/
[1] The statistics are based on the results of over 150,000 simulated emails sent to employees across 120 countries. Not all available phishing templates were distributed to every employee. Presented data includes templates sent to more than 100 users. Phishing simulation campaigns were held between January 2026 – September 2026.
