Phishing attacks increasing, but staff training can dramatically reduce risk

One in three Australian workers is likely to engage with a phishing email, with larger organisations at greater risk, new research has shown.

Editor’s note: This story first appeared on HR Leader’s sister brand, Cyber Daily.

A new report has shed light on the impact security awareness training can have in preventing phishing attacks, with even just 90 days reducing the chance of falling for a phishing attempt by more than 10 per cent.

At the same time, according to KnowBe4’s 2026 Phishing by Industry Benchmarking Report, phishing attacks have risen by 17.1 per cent over the last 12 months.

“As organisations in Australia and New Zealand expand their workforce from humans to include autonomous AI agents, the attack surface grows in ways traditional controls were not designed to address,” Dr Kawin Boonyapredee, KnowBe4’s Asia-Pacific CISO adviser, said in a statement.

“However, the data proves organisations can combat this through continuous personalised training, which drops employee phishing susceptibility to 5.3 per cent over 12 months.”

The numbers are pretty stark. Without training, the average phish-prone percentage in ANZ organisations is 33 per cent (the global average is 33.2 per cent). After 90 days of training, that figure drops to 21 per cent, and drops even further after a full year.

Africa has the highest baseline risk, at 35.9 per cent, followed by North America at 34.5 per cent. Asia has the lowest risk score, however, at 24.9 per cent.

KnowBe4 also found that the risk of a successful phishing attack rises the larger an organisation is. While the baseline risk is just 24.9 per cent for smaller businesses in the ANZ region, that figure jumps up to 54.5 per cent in organisations with more than 10,000 employees.

The specific industries with the highest baseline phishing risk remain banking, at 62 per cent, and healthcare and pharmaceuticals, at 41 per cent.

Want to see more stories from trusted news sources?
Make HR Leader a preferred news source on Google.