Zero to 345 in one campaign

The cohort: 3,115 people, none of whom had ever reported.

• Before: 0 reports from these 3,115 people, ever
• After: 345 reported for the first time

It took 3 nudges over 4 weeks and 1 reporting simulation, run 19–25 August 2026 and rebuilt from a real phishing email seen at the organisation.

‍

The problem: a reporting gap, not a susceptibility gap

These 3,115 people were not careless. They simply never told anyone.

Here's how the cohort compared with the CybSafe benchmark:

• Clicked: 6% for the cohort, against a CybSafe benchmark of 14%
• Phished: 3% for the cohort, against a CybSafe benchmark of 5%
• Reported: 12% for the cohort, against a CybSafe benchmark of 34%

PHISH counts first reports per person, so the security team can name these 345 rather than infer them from an average.

‍

What they did

• Used PHISH to identify every person with no recorded phishing report
• Split them into an intervention arm of 2,807 and a control arm of 308
• Sent the intervention arm three nudges over four weeks, through Teams and email
• Ran one reporting simulation to the whole cohort

‍

‍

The result

345 people who had never reported a phishing simulation have now done it once.

That is approximately 11% of the cohort, every one of them from a lifetime record of zero, and every one of them named in PHISH.

‍

Source: CybSafe PHISH, August 2026 Phishing Simulation. Cohort: 3,115 people with no previously recorded phishing report. First-time reporter = a person with no prior recorded report who reported this simulation.