According to industry studies:

• 90% of data breaches are the result of phishing. (Source)
• 85% of cyber attacks rely on social engineering, and 60% of the time this is done through phishing emails. (Source)
• Despite enhanced security measures, in 2021 US workers received an average of 14-49 malicious emails per year, and that number is increasing each year. (Source)

UD's 2013 cyberattack exposed more than 72,000 people to identity theft. The stolen data included names, addresses, Social Security numbers, and university identification numbers of current and past employees, including student workers and school officials.

UD security systems block millions of phishing messages each month, but some will always make it through. The best defense against these malicious emails is a user community made aware of the current phishing tricks and trends through regular practice.

A cyber security report – 2022 Annual State of Phishing Report, has analyzed millions of campaign results from users who have received simulated phishing training. The research found that repeated phishing simulations have been a helpful way to help employees spot malicious emails and hence, reduce their susceptibility. 70% of respondents were susceptible during their first encounter with a simulated phishing email. After simulations have been deployed 5 times, the percentage of susceptibility dramatically dropped to a single digit. A higher frequency of phishing simulations increases the ability to recognise phishing emails.

The report has also pointed out that users who clicked on a fraudulent link had one thing in common – they spent very little time checking the landing page of the phishing simulation. The average time spent was just 0-19 seconds according to the research. This implies the fact that the more time the staff are willing to spend on phishing education, the more capable they are to find out the red flags in a simulated phish.

The above standpoint is further assured by Microsoft's Digital Defense Report 2022. A popular website for cybersecurity news sources has quoted the finding from Microsoft, stating that “when employees receive simulated phishing training, they’re 50% less likely to fall for phishing.”

The annual state report we previously mentioned showed that 82% of trained employees reported simulated phishing. More amazingly is that they reported it within 60 minutes of receiving it. Timely user reporting not only decreases the window of opportunity that an adversary has to access data or gain further network entry but also increases the opportunity the security team has to detect and respond to potential breaches. The success of simulated phishing is further confirmed by another industry research, which indicates that after completing one year of phishing awareness training, the average phish-prone percentage sharply dropped from 37.9% to 4.7%, recording an astonishing 87% improvement rate. From the reports above, we can conclude that there’s a strong and direct relation between phishing simulation and employees' capability to spot and report phishing emails.

• They reduce the likelihood of a security incident and breaches

The graph below gives a visual insight into one study that measured how staff were able to recognise threats before and after training. As this shows, security awareness training makes staff much more capable of identifying potential cyber threats (Source).

• They reduce financial loss

According to IBM’s 2023 Cost of a Data Breach Report, the average cost of a data breach in the higher education and training sector was $3.65 million between March 2022 and March 2023. The mean time for all sectors to identify a data breach was 204 days with an additional 73 days on average to contain it.