Work-Themed Phishing Emails Trick 92% of Users
New simulation data reveals that professional context is the most effective vector for bypassing employee vigilance.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you feel confident in your ability to identify a sophisticated work-related phishing email?
A Kaspersky phishing simulation reveals that emails impersonating hygiene inspection reports trick 92 percent of employees into clicking. This research-stage analysis highlights how specific thematic lures, rather than generic templates, drive high success rates for deceptive emails.
Why it matters
Understanding which lures successfully bypass human vigilance allows organizations to better calibrate security training. The findings suggest that attackers increasingly leverage specific professional contexts, a trend likely to accelerate with generative AI.
The simulation tested various lures against a control, finding a 92% click-through rate for hygiene inspection reports compared to 45% for AI-related emails. Vulnerability drops from an initial 60% rate to 5-7% following participation in security awareness training.
The players
Kaspersky
A global cybersecurity firm that develops endpoint protection, threat intelligence, and security training platforms.
The details
The investigation utilized an automated security awareness training platform to send realistic, tailored emails to employees. These simulations mimic standard business procedures to increase attacker credibility. By leveraging topics closely aligned with an employee's daily work, attackers exploit inherent trust in professional communication channels.
Timeline
October 29, 2026: Kaspersky disclosed the phishing simulation results.
The Tech Race
This analysis marks a shift in how firms measure the efficacy of security training against increasingly context-aware phishing attempts. It contrasts with historical benchmarks that prioritized generic phishing indicators, emphasizing a focus on thematic sophistication.
Organizations should expect that their employees are most vulnerable to emails mirroring internal procedural workflows, such as inspections or approvals. Managers can reduce susceptibility from 60 percent to roughly 5 percent through consistent, simulated security awareness training.
The takeaway
Security leaders should audit their training platforms to ensure they reflect high-threat, industry-specific workflows. Monitor upcoming enterprise security standards that incorporate AI-generated phishing resistance into employee compliance benchmarks.
Further reading
For broader insights into modern defensive strategies, explore our Cybersecurity section.
Source note: This article includes information reported by 조선일보.
Live Poll
Do you feel confident in your ability to identify a sophisticated work-related phishing email?
