[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWfnT6wGnvDTPIOmJfoOYUzmrYBIPWGT7fP6-k9JCjh4":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":101},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"cbfb63f5-b868-4c59-bdb8-3718ec1cb5fa","Phishing Research Challenges Conventional Security Awareness Testing","phishing-research-challenges-conventional-security-awareness-testing-a9a3d7","Analysis of 2.47 million simulated attacks shows why organizations should measure credential leaks and reporting, not just clicks. The post Phishing Research Challenges Conventional Security Awareness Testing appeared first on SecurityWeek.","Pistachio's research analyzed 2.47 million simulated phishing attacks across over 1,200 organizations. The findings challenge conventional security awareness testing by showing that click rates alone are a poor indicator of actual risk. The study emphasizes the importance of measuring credential leaks and user reporting alongside clicks to gain a true understanding of an organization's phishing resilience.","Pistachio research reveals phishing simulations should measure credential leaks and reporting, not just clicks.","https:\u002F\u002Fwww.securityweek.com\u002Fphishing-research-challenges-conventional-security-awareness-testing\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-09-11T17:23:36+00:00","2026-09-11T18:00:08.159839+00:00",7,[17,20],{"name":18,"type":19},"Pistachio","vendor",{"name":21,"type":22},"AI","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[],[18],{"controls":44,"vendors":100},[45,74],{"slug":46,"name":47,"problem":48,"products":49},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":75,"name":76,"problem":77,"products":78},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[79,87,94],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":88,"product_name":91,"url":92,"description":93},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":95,"product_name":96,"url":98,"description":99},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":102,"title":103,"body":104,"framework_refs":105,"framework_notes":114},"click-rates-alone-dont-measure-phishing-risk-heres-what-does","Click Rates Alone Don't Measure Phishing Risk — Here's What Does","Organizations have long relied on phishing simulation click rates as the primary metric for measuring employee security awareness, but new research shows this approach is fundamentally flawed. Analyzing 2.47 million simulated attacks, Pistachio's study found that click rates fail to capture the full risk picture — credential submission rates and user reporting behaviors are far more predictive of real-world vulnerability. An employee who clicks but doesn't submit credentials represents a very different risk profile than one who hands over their password. Without measuring the right indicators, security teams may have a false sense of confidence in their workforce's resilience. This matters because phishing remains one of the leading initial access vectors in breaches, and miscalibrated training programs leave critical gaps unaddressed.",[106,107,108,109,110,111,112,113],"CIS Control 14: Security Awareness and Skills Training","CIS Control 8: Audit Log Management","NIST SP 800-50: Building an Information Technology Security Awareness and Training Program","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 AT-3: Role-Based Training","NIST CSF DE.CM-3: Personnel activity monitoring","GDPR Article 39: Tasks of the Data Protection Officer (training obligations)","ISO 27001 Annex A.7.2.2: Information Security Awareness, Education and Training",{}]