Report
Phishing By Industry Benchmark Report 2026: Australia and New Zealand
How Vulnerable Is Your Organisation to Phishing? Get the 2026 ANZ Phishing Benchmarking Report to Find Out
Phishing-enabled breaches are accelerating across Australia and New Zealand — with nearly two-thirds of security and IT leaders admitting they've clicked on malicious links. Business email compromise remains the top incident type, while espionage attacks now take an average of 404 days to detect. The steepest year-on-year increases in organisational breaches have been reported in ANZ, often starting with a single compromised employee. Generative AI is making it worse, enabling threat actors to craft convincing, localised phishing lures that slip past email gateways. The barrier to breach is no longer technology. It's the person who receives the email.
The 2026 KnowBe4 Phishing by Industry Benchmarking Report for Australia and New Zealand measures real employee susceptibility across industries and organisation sizes — giving security leaders the data they need to benchmark their risk and make the case for stronger awareness programmes.
What you'll learn
- Which sectors carry the highest baseline risk — Banking (62%), Healthcare & Pharmaceuticals (41%) and the specific vulnerabilities driving these figures
- Why enterprise organisations are the most exposed at baseline (54.5%) but deliver the fastest returns, dropping to 16.7% within 90 days
- How all organisation sizes converge to between 4.3% and 5.7% after one year of sustained training — and why continuous simulation outperforms annual compliance
- Why sector benchmarking, not regional averages, reveals your true risk profile
- How security awareness training bridges the gap between regulatory obligation (Cyber Security Act 2024, Privacy Act) and operational resilience
Topics
Email Security
Human Security
Risk Management
Cyber Threats