Ongoing training reducing the risk of phishing attacks

Over one-third of corporate employees in Africa are susceptible to phishing and social engineering attacks, but regular training can substantially diminish their vulnerability to such cyber threats. This insight emerges from KnowBe4’s 2023 Phishing by Industry Benchmarking Report for Africa, which gauges an organization’s Phish-prone Percentage (PPP), an indicator of how many employees are likely to fall for phishing or social engineering scams.

The report, based on data from 12.5 million users across 35,681 organizations in 19 industries, encompasses results from 32.1 million simulated phishing security tests. The study includes international phishing benchmarks from various regions, and within Africa, 412 organizations from South Africa, Kenya, Nigeria, and Botswana participated in phishing simulation tests, with 337,937 emails sent.

African businesses, primarily small (58%), medium (26%), and large (16%), showed a lower baseline PPP compared to other regions, indicating they were less susceptible to phishing attacks prior to training. However, their improvement after 90 days of training was less pronounced. Yet, after a year of ongoing training, African users demonstrated a 79.8% reduction in PPP, highlighting the effectiveness of consistent security awareness education.

Anna Collard, Senior VP of Content Strategy & Evangelist for KnowBe4 Africa, emphasized that while technology is crucial in cyber defense, the human factor cannot be disregarded. The report demonstrated that without security training, 33.2% of employees across regions and industries are susceptible to phishing attacks. Africa’s average was 32.8%, better than the global average.

After 90 days of training, Africa’s average PPP was 20.5%, compared to the global average of 18.5%. A year of consistent training lowered Africa’s PPP to 6.6%, highlighting the development of improved security habits and culture. Medium and large enterprises exhibited the most significant improvements, emphasizing the value of ongoing cybersecurity awareness training.

The report also revealed industries with higher PPPs, emphasizing their greater need for security awareness training. The healthcare and pharmaceutical sectors had the highest PPP among small and medium organizations, while the insurance industry remained most at risk for larger organizations. The report underscores the need for continual cybersecurity training to embed a strong security culture within companies.