Personalization Increases Click Rates

The report shows that personalization significantly increases click rates: the two most clicked subject lines contained the name of the recipient's company. Internal topics dominated engagement and appeared in 100% of the top 10 most clicked subject lines, while HR-related themes were mentioned in 46%. Emails resembling IT notifications, training updates, and routine HR communications consistently ranked among the most effective phishing methods. These findings confirm insights from the State of Human Risk Report 2025: The New Paradigm of Securing People in the AI Era, which emphasizes the critical importance of integrated human risk management as cybercriminals deploy increasingly sophisticated phishing techniques.

Also read: Why Security Awareness Remains Crucial

Domain Spoofing Appears in Nearly 90% of the Most Clicked Attacks

Analysis of the phishing delivery methods used further underscores these trends. Of the 20 most clicked hyperlinks, approximately 87% referred to internal topics and involved 90% domain spoofing. This highlights how accurately attackers imitate legitimate business infrastructure to build trust and provoke swift action.

Additionally, the report analyzed real phishing threats reported via the KnowBe4 Phish Alert Button. The top 10 most reported phishing attacks often posed as trusted brands such as Microsoft, ShareFile, Google, Zoom, Adobe, Coinbase, and DHL, as well as internal IT and HR departments. In total, 62% of the phishing landing pages that users interacted with featured branding, with Microsoft accounting for 22.9% of the spoofed brands. Social media platforms collectively represented 14.5%.

Also read: What is a CASB?

'The fact that nearly 90% of the most clicked phishing attempts involve domain spoofing shows that attackers know how to create very convincing illusions of legitimacy,' said Erich Kron, CISO advisor at KnowBe4. 'When employees see their company name, their manager's name, or trusted internal systems in an email, their natural tendency is to trust the message and act quickly. Organizations must recognize that technology alone is not enough. Building a security-aware culture where employees feel supported to pause and verify is our strongest defense against attacks that increasingly know how to mislead us.'

Also read: Companies Not Prepared for Quantum-Driven Cyber Threats