Auto Phishing and Benchmarking: Summer’s Key Security Releases

Takeaway	Detail
86% reduction in phishing click rates	KnowBe4's 2025 report found that sustained security awareness training cuts phishing click rates by 86% over 12 months across all industries.
Global baseline PPP is 33.2%	KnowBe4's 2026 benchmark reports that roughly one in three employees is susceptible to phishing before any training intervention.
Africa shows highest baseline (35.9%) and residual risk (7.4%)	The 2026 report identifies Africa as the region with the highest initial phishing-prone percentage and the highest vulnerability after one year of training.
Healthcare, Insurance, and Retail remain highest-risk industries	For the second consecutive year, these three sectors lead in phishing susceptibility across all organization sizes in KnowBe4's 2026 data.
Run baseline, 90-day, and 1-year simulations to measure improvement	Standard benchmarking protocol requires a pre-training simulated campaign, then repeat tests at 90-day and 12-month intervals to track PPP reduction.
Self-hosted tools like Gophish and Evilginx2 enable full data control	Open-source frameworks allow organizations to customize phishing templates, capture MFA-bypass scenarios, and keep all metrics on-premises.
Summer staffing gaps widen phishing windows	Seasonal understaffing and slower inbox monitoring create extended opportunities for successful attacks, making summer a critical period for benchmarking.
Hoxhunt's 2026 report analyzed 50 million data points from 4 million users	The largest independent phishing trends dataset to date provides granular benchmarks on attacks that bypass security filters, complementing KnowBe4's industry-specific findings.

Item	Rule / threshold
Global baseline PPP	33.2%
Africa baseline PPP	35.9%
Africa residual risk (1 year)	7.4%
Click-rate reduction after 12 months training	86%
Standard benchmarking intervals	Baseline, 90-day, 1-year

This summer has brought two major independent benchmarks for understanding organizational phishing risk. KnowBe4's annual Phishing by Industry Benchmarking Report now covers 19 industries, four organization sizes, and seven global regions, while Hoxhunt's Phishing Trends Report analyzed over 50 million data points from more than 4 million users worldwide. Together, these releases provide the most comprehensive picture yet of baseline susceptibility, training effectiveness, and the attack vectors that evade technical controls.

Readers will learn the standard benchmarking protocol (baseline, 90-day, and 1-year intervals), which industries face the highest residual risk, and why summer staffing gaps create a critical window for both attackers and defenders.

Key Metrics in a Phishing Benchmark Report

A phishing benchmark report is defined by three core metrics: click-through rate (CTR), credential-entry rate, and phishing-prone percentage (PPP). CTR measures the proportion of users who click a simulated phishing link. Credential-entry rate tracks how many of those users then submit login credentials on a fake page. PPP is the broader measure of users who fail a simulated test by clicking or entering data, typically reported as a baseline, then at 90 days, and again after one year of training.

The 2026 KnowBe4 Phishing by Industry Benchmarking Report, which covers 19 industries, four organization sizes, and seven global regions, uses PPP as its primary benchmark. The report provides baseline PPP before any training, then measures residual risk after 90 days and after 12 months. This structure allows organizations to compare their own simulation results against a global peer set. The Hoxhunt 2026 Phishing Trends Report, drawing from over 50 million data points across more than 4 million users, benchmarks real phishing attacks that bypass technical filters, offering a different lens focused on live threats rather than simulations.

A critical distinction is whether the benchmark measures simulated test performance or real-world attack susceptibility. KnowBe4’s report is simulation-based, giving a controlled measure of training effectiveness. Hoxhunt’s report analyzes actual user-reported phishing attempts, capturing data on attacks that evade email security gateways. The APWG Phishing Activity Trends Report takes a third approach, aggregating phishing URLs and campaigns reported by member organizations and the public, providing a macro view of attack volume and technique evolution rather than per-user metrics.

When evaluating a benchmark report, look for segmentation by industry, organization size, and region. Reports that provide this granularity enable more accurate internal target setting.

A common mistake is treating a single benchmark as a pass-fail grade. The value comes from trend analysis over multiple testing cycles. A static or rising PPP signals that training content, frequency, or delivery method needs adjustment. The credential-entry rate is a more severe indicator than CTR alone — a user who enters credentials has demonstrated a higher-risk behavior than one who merely clicks.

To apply this today, locate the 2026 KnowBe4 Phishing by Industry Benchmarking Report on their official site and find your industry and organization size row. Compare your most recent simulation results against the baseline and 90-day PPP columns. If your numbers exceed the benchmark for your peer group, schedule a review of your training curriculum and testing cadence within the next two weeks.

Setting Up Automated Phishing Simulations with Gophish

Gophish is an open-source phishing framework that lets you run fully automated simulations from a self-hosted server. You control every variable: email templates, landing pages, target lists, and reporting. The standard deployment uses pre-compiled binaries for Linux, Windows, or macOS. Download the latest release from the official Gophish GitHub repository, extract the archive, and run the binary. The admin interface listens on port 3333 by default. Log in with the auto-generated credentials printed to the terminal on first launch.

The core workflow has four steps. First, create a sending profile with your SMTP server details. Gophish supports STARTTLS and SSL, so you can route through a legitimate mail relay or a dedicated simulation server. Second, build an email template using the built-in HTML editor or import raw HTML. You can inject dynamic fields like {{.FirstName}} and {{.TrackingURL}} to personalize each message. Third, design a landing page that mimics a login screen or document share. Gophish captures credentials submitted through these pages and logs the timestamp. Fourth, upload a target list as a CSV file with columns for email, first name, and last name. The system handles deduplication automatically.

To automate recurring campaigns, use the Groups and Schedules features. Create a static group of targets, then attach it to a campaign with a defined start time and send rate. The send rate controls how many emails go out per hour, which helps avoid tripping spam filters. For ongoing testing, duplicate a completed campaign and update the target list. Gophish does not have a native API for full automation, but you can script campaign creation using its REST API endpoints. The API supports JSON payloads for sending profiles, templates, landing pages, and campaigns. This allows integration with CI/CD pipelines or ticketing systems.

A common edge case is email deliverability. Self-hosted Gophish instances often send from IPs not on allowlists, causing messages to land in spam folders. Configure SPF, DKIM, and DMARC records for your sending domain. Use a dedicated subdomain like phish-sim.yourcompany.com to isolate reputation risk. Another edge case is MFA-bypass testing. Gophish alone cannot capture session cookies. For that, pair it with Evilginx2, a reverse proxy that intercepts both credentials and session tokens. The combination is called EvilGophish, and several community guides walk through the setup. This is useful for advanced simulations where you want to test response to credential theft that bypasses multi-factor authentication.

One caveat: Gophish stores all captured credentials in plaintext in its SQLite database. If you run simulations that collect real passwords, restrict database access to authorized administrators only. Enable HTTPS on the admin interface using a reverse proxy like Nginx. Do not expose the admin port to the internet. For organizations subject to compliance requirements, check whether your legal or privacy team requires explicit consent from simulated users before launching campaigns.

To start today, download the Gophish binary for your operating system from the official GitHub releases page. Deploy it on a virtual machine or container with a static IP address. Configure your sending domain’s SPF and DKIM records before sending the first test email. Run a five-user pilot campaign with a benign template — a fake IT notice about password expiration — and verify that results appear in the dashboard within 24 hours.

Open-Source Tools for MFA-Bypass Phishing Testing

For MFA-bypass phishing testing, the primary open-source tool is Evilginx2, a reverse proxy that captures both credentials and session cookies. Gophish alone cannot intercept session tokens, so the standard approach is to pair it with Evilginx2 in a setup commonly called EvilGophish. Several community guides document the full configuration, which involves routing traffic through Evilginx2's proxy while Gophish handles campaign management and reporting.

The mechanism works by positioning Evilginx2 between the target and the legitimate login page. When a user submits credentials and a one-time passcode or push notification approval, the proxy forwards the request to the real service and captures the session cookie returned in the response. This cookie allows the tester to replay the authenticated session, effectively bypassing MFA. The captured data is logged locally, and Gophish records the event as a successful credential harvest.

A common edge case is certificate management. Evilginx2 requires valid TLS certificates for the phishing domain to avoid browser warnings. You can obtain free certificates via Let's Encrypt using Certbot, or use a self-signed certificate for internal testing only. Another edge case is session cookie expiration. Some services issue short-lived cookies that expire within minutes or hours, so the testing window is narrow. Plan simulations to coincide with active user sessions, typically during business hours.

One caveat: Evilginx2 is a passive proxy and does not modify responses. If the target service uses certificate pinning or WebAuthn (FIDO2/Passkeys), the proxy cannot bypass those controls. For testing against hardware security keys or biometric MFA, you need a different approach, such as social engineering the user to approve a push notification on a compromised device. Also, running MFA-bypass simulations without explicit written consent from the organization's legal team may violate anti-hacking laws in some jurisdictions. Check your local computer fraud statutes before deploying.

To start today, download the latest Evilginx2 release from its official GitHub repository. Deploy it on a Linux virtual machine with a public IP address and a domain name you control. Configure the phishlet — a YAML file that defines the target service's login flow — for the application you want to test. Test with a single volunteer user before expanding to a full campaign. Verify that the captured session cookie works by importing it into a browser's developer tools and accessing the target service without re-authenticating.

What Are the Highest-Risk Industries in the 2026 Benchmarks?

The three highest-risk industries in the 2026 benchmarks are Healthcare & Pharmaceuticals, Insurance, and Retail & Wholesale, according to KnowBe4's annual Phishing by Industry Benchmarking Report. These three sectors held the top spots for the second consecutive year, indicating persistent structural vulnerability rather than a one-time anomaly. The report covers 19 industries, four organization sizes, and seven global regions, providing baseline, 90-day, and one-year phishing-prone percentage (PPP) benchmarks.

These figures come from millions of simulated phishing tests aggregated by KnowBe4, not from self-reported surveys.

The mechanism driving high risk in these industries is the combination of high email volume, frequent use of third-party vendors, and the presence of sensitive data that attackers can monetize. Healthcare organizations handle protected health information (PHI) under HIPAA, making a single credential compromise potentially worth thousands of dollars on dark web marketplaces.ets. Insurance companies process claims and payments that require rapid email-based approvals, creating pressure to click quickly. Retail & Wholesale operates on thin margins with high transaction volumes, where a delayed response to a fake invoice or shipping alert can disrupt supply chains.

One edge case worth noting is organization size. The 2026 benchmarks show that small organizations (under 250 employees) in high-risk industries often have baseline PPPs 5–8 percentage points higher than their large-enterprise counterparts. This is likely because small businesses lack dedicated security teams and rely on default email configurations.

A caveat: the KnowBe4 benchmarks measure susceptibility to simulated phishing campaigns, not real-world attack success rates. Real attacks often use more sophisticated lures, including MFA-bypass techniques via tools like Evilginx2, which can capture session cookies even after a user passes the initial phishing test. The benchmark data should be interpreted as a relative risk indicator, not an absolute prediction of breach likelihood.

To apply this information today, compare your organization's internal phishing simulation results against the KnowBe4 2026 industry baseline for your sector and size tier. If your baseline PPP exceeds the industry average by more than 5 percentage points, prioritize deploying a structured security awareness training program. Start by running a baseline simulation using Gophish with a benign template, then schedule monthly training modules and quarterly re-tests to track progress against the published benchmarks.

How to Interpret Click-Through vs. Credential-Entry Rates?

Click-through rate (CTR) measures the percentage of users who click a link in a simulated phishing email. Credential-entry rate (CER) measures the percentage who then submit their username and password on the landing page. The ratio between these two numbers reveals the depth of the vulnerability. A high CTR with a low CER suggests users are curious but cautious, while a high CER indicates a trained reflex to comply with login prompts.

The 2026 KnowBe4 Phishing by Industry Benchmarking Report provides baseline, 90-day, and one-year phishing-prone percentage (PPP) benchmarks across 19 industries and four organization sizes. The Hoxhunt 2026 Phishing Trends Report, drawing from over 50 million data points from more than 4 million users, offers a complementary view focused on attacks that bypass security filters. When interpreting your own simulation results, compare your CTR and CER against these published benchmarks for your industry and size tier.

One edge case is the use of MFA-bypass tools like Evilginx2 in authorized simulations. These tools capture session cookies, meaning a user who does not enter credentials can still be compromised. In such tests, the CER may be low, but the actual risk remains high because the attacker gains persistent access. Standard benchmarks from KnowBe4 and Hoxhunt do not typically include MFA-bypass scenarios, so you must interpret those results separately. If your organization runs Evilginx2-based simulations, track the cookie-capture rate as a distinct metric alongside CTR and CER.

A common practitioner mistake is treating CTR and CER as interchangeable. They are not. A user who clicks but does not enter credentials has demonstrated some awareness, whereas a user who enters credentials has demonstrated a dangerous compliance habit. Training programs should target each behavior differently. For high-CTR, low-CER groups, focus on link inspection and reporting. For high-CER groups, emphasize password hygiene and the principle of never entering credentials from an email link.

To apply this today, run a baseline simulation using Gophish with a benign template that captures both CTR and CER separately. Compare your organization's CER-to-CTR ratio against the industry benchmarks from the KnowBe4 2026 report. If your conversion rate (CER divided by CTR) exceeds 50%, prioritize training modules that specifically address credential-entry behavior. Schedule a follow-up simulation in 90 days to measure the delta, and repeat quarterly to track progress against the published one-year benchmarks.

What Steps Ensure a Secure, Isolated Testing Environment?

To ensure a secure, isolated testing environment for automated phishing simulations, you must deploy the infrastructure on a separate network segment with no access to production systems. Use virtual machines or containers — Docker or VMware Workstation are common choices — that are snapshotted before each campaign so you can revert to a clean state. The test domain should be a registered subdomain you control, never a live corporate domain, and the SMTP server must be configured to send only to test addresses within your isolated environment. This prevents accidental delivery to real users or external parties.

Gophish, the open-source phishing framework, provides full campaign management including email templates, landing page hosting, and reporting dashboards. Install it on a dedicated Linux VM with a static IP that is firewalled from production traffic. Configure the sending profile to use a dedicated mail server or a transactional email service like SendGrid on a test API key, never your corporate mail relay. The landing page should mimic a login portal but must not collect real credentials — use a benign template that records clicks only, or if you are testing credential-entry behavior, store hashed values without logging plaintext passwords.

For MFA-bypass testing with Evilginx2, the isolation requirements are stricter. Evilginx2 acts as a reverse proxy that captures both credentials and session cookies. Deploy it on a separate cloud instance or local server with its own public IP, and ensure the phishing domain is registered under a name that does not resemble your organization's real domain. The proxy must terminate TLS with a valid certificate from Let's Encrypt or a similar CA. After each test session, revoke the certificate and destroy the instance to prevent any residual cookie data from being reused.

One edge case is the use of real user email addresses in test lists. Even in an isolated environment, if you import actual employee emails, a misconfigured SMTP relay could send test emails to production inboxes. The safer approach is to create synthetic user accounts — for example, [email protected] — and map them to roles in your simulation. This also avoids privacy concerns under GDPR or similar regulations. The KnowBe4 2026 Phishing by Industry Benchmarking Report covers 19 industries, four organization sizes, and seven global regions, providing baseline, 90-day, and one-year phishing-prone percentage benchmarks. Use these published figures to calibrate your test scenarios, not to justify testing on real users.

A common practitioner mistake is running simulations from the same network as production users. If your test server shares a VLAN with employee workstations, a compromised test instance could be used as a pivot point. Always place the phishing server in a separate DMZ or cloud VPC with strict egress rules. Log all outbound connections from the test environment and monitor for unexpected traffic. The APWG Phishing Activity Trends Report, which analyzes attacks reported via [email protected], shows that real phishing infrastructure often uses similar isolation techniques — meaning your test environment should mirror attacker setups to produce realistic results.

To apply this today, set up a Gophish instance on a fresh Ubuntu 24.04 VM in a cloud provider like AWS or DigitalOcean, using a dedicated VPC with no peering to production. Register a test domain through a registrar like Namecheap, configure SPF and DKIM records for deliverability, and run a single benign campaign against synthetic users. Verify that no emails leaked to production by checking your corporate mail logs. Then snapshot the VM so you can repeat the test quarterly, comparing your results against the industry benchmarks from the KnowBe4 2026 report.

When to Choose Simulated Phishing Over a Live-Fire Exercise?

Choose simulated phishing when your primary goal is measuring baseline human risk, not testing network defenses. A simulated phishing campaign uses benign email templates and fake landing pages to record how many employees click a link or enter credentials. This method is safe for production environments because no actual malware is deployed and no real data is exfiltrated. Live-fire exercises, by contrast, deploy real exploit payloads against internal systems to test detection and response controls. They require extensive legal approvals, network isolation, and rollback plans. For most organizations, simulated phishing is the correct default for quarterly or annual employee assessments.

The mechanism is straightforward. You deploy a tool like Gophish or a commercial platform such as KnowBe4, create a template that mimics a common threat — a fake Office 365 login page or a bogus package delivery notice — and send it to a test group. The platform logs clicks and credential submissions without storing plaintext passwords. The result is a phishing-prone percentage (PPP) that you can compare against industry benchmarks. KnowBe4's 2026 report covers 19 industries, four organization sizes, and seven global regions, providing baseline, 90-day, and one-year PPP figures. Healthcare, Insurance, and Retail & Wholesale were the highest-risk industries for the second consecutive year in that report.

Live-fire exercises serve a different purpose. They validate whether your security operations center (SOC) can detect a real intrusion, whether endpoint detection and response (EDR) tools block execution, and whether incident response playbooks work under pressure. These exercises typically use frameworks like Atomic Red Team or Caldera to simulate adversary behavior. The tradeoff is operational risk: a misconfigured payload could cause a real outage, and the exercise requires a dedicated red team or external penetration testers. For organizations without a mature SOC or without legal clearance for active defense testing, live-fire exercises are premature.

One edge case is the use of Evilginx2 for MFA-bypass testing. Evilginx2 is a reverse proxy tool that captures both credentials and session cookies, enabling MFA bypass during authorized phishing simulations. This sits between simulated phishing and live-fire because it tests a real attack technique but still uses a controlled proxy rather than deploying malware. If your organization uses MFA and you want to measure whether employees would approve a fake Duo push notification, a simulated phishing campaign with Evilginx2 is appropriate. The isolation requirements are strict: deploy it on a separate cloud instance with its own public IP, use a test domain that does not resemble your real domain, and destroy the instance after each session.

A common practitioner mistake is running simulated phishing without a baseline measurement. The correct sequence, as documented in the KnowBe4 benchmarking methodology, is to run a campaign before any training intervention, then repeat at 90-day and one-year intervals. Running simulations after training without a pre-training benchmark inflates your improvement numbers and hides the actual risk level.

To apply this today, decide which question you are answering. If the question is "how many employees would fall for a credential-phishing email?" then simulated phishing with Gophish or KnowBe4 is the correct tool. If the question is "can our SOC detect and contain a real intrusion?" then schedule a live-fire exercise with a qualified red team. Do not mix the two. Set a calendar reminder to run your baseline simulated campaign within the next 30 days, using synthetic user accounts and a dedicated test domain, and record the PPP before any training begins.

What to do next

The reports and tools covered in this guide provide a strong foundation for understanding the current phishing landscape and testing your own defenses. The following steps will help you translate these benchmarks into actionable security improvements without relying on any single vendor.

Step	Action	Why it matters
1	Download the full KnowBe4 2026 Phishing by Industry Benchmarking Report from knowbe4.com to compare your organization’s PPP against your sector and size.	Provides a neutral, data-backed baseline to identify whether your human risk is above or below the industry median.
2	Review the Hoxhunt 2026 Phishing Trends Report at hoxhunt.com to understand which attack vectors (e.g., MFA bypass, voice phishing) are currently bypassing technical filters.	Helps prioritize simulation scenarios based on real-world attacker behavior, not guesswork.
3	Set up a test environment using the open-source Gophish framework (getgophish.com) to run a baseline simulated phishing campaign on a small, consenting group.	Establishes your own internal benchmark without licensing costs, using the same methodology as commercial reports.
4	If your team has advanced authorization, deploy EvilGoPhish on a dedicated VPS to test resistance to MFA-bypass attacks using session cookie capture.	Validates whether your MFA implementation can withstand the most common summer attack pattern.
5	Cross-reference your results with the APWG Phishing Activity Trends Report (apwg.org/trendreports) to see if your observed attack types match global patterns.	Ensures your testing aligns with the actual threat landscape, not outdated scenarios.
6	Schedule a 90-day retest on the same user cohort and compare the PPP change against KnowBe4’s reported 86% reduction benchmark for trained users.	Measures the effectiveness of any training or policy changes you implement, using an industry-standard metric.

Also worth reading: Cyber-Cops Disrupt Phishing Playground LabHost Takedown Hits Cybercriminals Hard · The Psychology of Digital Trust How Modern Phishing Attacks Exploit Human Decision-Making Patterns · Anthropological Insights 7 Lessons from Smartphone Benchmarking for Understanding Cultural Progress · The Ancient Roots of Modern Security Strategy How Historical Leadership Principles Shape Today's National Security Thinking

Sources: businesswire, prnewswire, apwg, kymatio, knowbe4