KnowBe4 Research Finds Global Phishing Susceptibility Drops 79% After One Year of Security Awareness Training

KnowBe4 reported that consistent security awareness training (SAT) can cut phishing susceptibility by 79% after one year, based on 42 million phishing simulations across 14.8 million users at 64,000 organizations. The benchmark comes as the threat landscape increasingly uses AI, but the company’s data suggests training materially reduces employee vulnerability despite that headwind.

Analysis

The incremental read-through is not that phishing disappears; it’s that buyers now have a measurable, board-friendly ROI story for a cheap control layer. That tends to favor vendors that can prove behavior change and integrate with identity/email workflows, especially where procurement is driven by cyber insurance, audit findings, and incident-response lessons. Public-market beneficiaries are likely the broader cyber platform names with cross-sell into identity and awareness workflows—CRWD, PANW, and to a lesser extent OKTA—rather than pure email-filtering tools, because those platforms own the budget conversation and can bundle remediation.

The second-order effect is that AI-driven phishing may actually make security budgets less cyclical: when attack quality rises, the easiest incremental spend is still user training plus phishing-resistant authentication, not multi-year rip-and-replace projects. That is supportive for renewal-heavy software economics over the next 1-3 quarters, but the structural effect over 6-18 months is more about vendor consolidation and tougher proof-of-value requirements. The main losers are vendors whose pitch is "we reduce risk" without hard metrics; buyers will increasingly demand reduction curves, not feature lists.

The contrarian point is that simulation data likely overstates real-world loss reduction because it measures test behavior, not live adversary adaptation, and training effects decay quickly without reinforcement. If breach frequency or click-through rates stop improving in customer cohorts, the thesis weakens. Near term this is a sentiment-positive but not thesis-changing cyber data point; the trade is to own the names that monetize measurable controls, not to chase the headline itself.

Key Decisions for Investors

• Buy CRWD on a 2-4% pullback over the next 2-6 weeks; thesis is that identity/threat-detection budgets stay sticky as boards prioritize measurable phishing mitigation. Falsify if management commentary shows seat growth slowing or net retention compressing below prior trend.
• Initiate a modest long basket in HACK or CIBR for 3-6 months; this is a broad cyber-spend continuation trade rather than a single-name call. Risk/reward is better on dips than after the headline pop.
• Overweight PANW versus the IGV software ETF into the next earnings cycle; if phishing/identity spend rises, security should outgrow general software. Exit if PANW billings or RPO decelerate versus peer cyber names.
• Use OKTA as a watchlist long only if management frames phishing-resistant auth adoption as budget-incremental, not budget-neutral; otherwise the thesis is too dependent on product mix and may not translate to upside.
• No direct trade in the article source itself; treat it as a procurement/renewal signal. Reassess if a public vendor cites improved renewal or expansion rates tied to awareness/training in the next 1-2 quarters.