Report

Why phishing still works in 2026

Based on 11 million phishing simulations across 10 European countries, this report from Nimblr reveals what drives clicks, why phishing continues to succeed, and how organizations can turn awareness into real behavior change.

Phishing doesn’t succeed because people don’t know better, it succeeds because attacks are designed for how people behave. Download the report to understand what employees actually click.

Download report

TRUSTED BY:

Phishing report

Access the phishing report

Based on data from 11 million phishing simulations, the report provides a closer look at how employees respond to different types of phishing emails and what these patterns mean for organizations building security awareness.

SECURITY AWARENESS

Phishing

Phishing remains one of the most effective forms of cybercrime, despite decades of awareness efforts and technical protection.

Rather than targeting technical weaknesses, modern phishing is designed to match how people actually work. Emails that appear to come from HR or IT, use local language, or mimic routine workplace tasks consistently generate the highest click rates, even among trained users.

Phishing continues to work not because people are careless, but because attackers understand and exploit everyday work patterns.

Get to Know Nimblr

Nimblr can help you transform your employees into cybersecurity experts.

Micro training

Users undergo continuous testing and security awareness training to drive positive behavioral change.

Simulated attacks

Simulated attacks are tailored to fit your company’s size, sector, and location.

Instant learning

Courses are offered in 30+ languages and are connected to common activities and real-world IT threats.

Zero-Day classes

Nimblr Zero-Day classes use real-life attacks and examples to help users recognize current threats. These courses automatically update with regionally significant risks, addressing immediate threats by targeting critical knowledge gaps.

Set & Forget-configuration

Nimblr is a self-governing educational solution that requires minimal manual effort from administrators.

Automated reporting

User progress and awareness levels are summarized in automated monthly reports.