2026 State of Phishing: Click Rates Are Down, But Attacks Are Smarter

Our annual State of Phishing report analyzes trends from simulated phishing campaigns run through the Guard platform. This year's findings reveal a maturing security awareness landscape — but also a threat actor community that is adapting faster than ever.

Key findings

1. Overall click rates continue to decline

The global average phishing simulation click rate fell to 4.2% in 2026, down from 5.8% in 2025 and 8.1% in 2024. Organizations with continuous training programs achieved an average click rate of 2.1%, compared to 7.4% for annual-only training.

Healthcare (6.8%), education (6.2%), and government (5.9%) remain the highest-risk sectors, while technology (2.4%) and financial services (3.1%) lead in resilience.

2. QR code phishing is the fastest-growing vector

QR code-based phishing attacks grew 3.2x year-over-year. In simulations, QR phishing achieved a 12.3% click rate — nearly triple the average — because employees scan codes with personal devices lacking corporate security controls.

3. AI-generated phishing content is harder to detect

AI-generated simulation templates achieved a 6.1% click rate versus 3.8% for traditional templates. The AI emails had fewer errors, more convincing personas, and better localization. This mirrors real-world attack trends.

The days of spotting phishing by looking for typos are over. Defenders need to shift from content-based detection to behavioral indicators — urgency, authority pressure, and unusual requests.

4. Report rates are the better metric

The average report rate reached 67%, up from 54% in 2025. Organizations in the top quartile achieved report rates above 82%.

5. Just-in-time coaching works

Employees who received immediate coaching after clicking were 74% less likely to click on the next simulation.

Methodology

Based on aggregated data from simulated phishing campaigns run January–August 2026 across Guard platform customers. Simulation types: credential harvesting (42%), payload delivery (18%), business email compromise (24%), data exfiltration (16%).