🎙️
Voice deepfakes are now the second most common payload.
Up from sixth in 2024. The rise tracks the cost curve of consumer-grade voice cloning tools.
Phishing Index · 2026 edition
The state of the human firewall, in numbers.
The annual SimuPhish report. 2.1M employees. 38 countries. 75+ languages. The data we wish someone had given us when we started.
0%
Growth in attacks targeting employees since 2022
0s
Median time to click on a modern AI lure
0%
Average report rate inside SimuPhish customer base
0+
Languages our drills shipped in this year
Top findings
Four numbers that changed the playbook.
🧾
Vendor invoice swap dominates finance team incidents.
78% of finance-led incidents in 2025 traced back to a vendor identity swap, not a credential leak.
🌍
Arabic, Hindi, and Tagalog drills moved the needle most.
Localised content lifted report rates by 31 points on average across three of our biggest customers.
📈
HDR Score has become a board-level KPI.
92% of customers we surveyed now report HDR Score in their quarterly board pack. Up from 0% in 2023.
By region · 2025
Click rate vs report rate.
North America
Click
8.2%
Report
44%
EMEA
Click
6.7%
Report
52%
MENA
Click
9.4%
Report
38%
APAC
Click
7.1%
Report
49%
LATAM
Click
10.6%
Report
33%