2018 Phishing Trends Report
Open, click and submission rates from over 700,000 phishing simulation emails in 2018, compared by department.
Archive edition. This report uses 2018 phishing simulation data, so the rates are dated. Tracking open, click and submission rates over time, by department, is still a useful way to see progress. See the latest
What the data shows
- 700,000Over 700,000 phishing simulation results from 258 companies were analysed anonymously for 2018.See page 1
- 49.32%Of 2018 simulation emails, 49.32% were opened by the target.Page 4, in the full report
- 33.10%Of 2018 simulation emails, 33.10% had the link or attachment clicked.Page 4, in the full report
- 1 in 2Employees in Legal/Audit/Internal Control, Purchasing/Administrative Affairs and Quality Management/Health were likely to open a phishing simulation email in 2018.See page 3
- 1 in 5Employees in those same three departments were likely to share the information a phishing simulation email asked for in 2018.See page 3
Start reading
- 1 / 10
- 2 / 10
- 3 / 10
Read the other 7 pages
They open right here. You can also download the PDF.
Tap a page to read it full size.
What the report covers
- Executive summary
- Overview
- Statistic overview
- Statistics by department
- Percentage of emails read by recipients
- Percentage of emails that had links clicked by recipients
- Percentage of emails recipients shared information
- Conclusion
Who it is for
Security and awareness leads comparing phishing simulation results across departments and years.
How the data was collected
- Sample
- Over 700,000 sanctioned phishing simulation emails from 258 companies
- Period
- 1 January 2018 to 1 January 2019
- Source
- Anonymous data from organisations using the Keepnet platform
- Note
- Clicks and attachment downloads are combined into one click rate. Department figures only include customers that grouped employees by department. The company count appears on the cover only.
Cite this report
Keepnet (2018). 2018 Phishing Trends Report. https://keepnetlabs.com/reports/2018-phishing-trends-report
Figures on this page may be quoted with this citation.
Phishing Simulator
Run multi-channel phishing simulations, not email-only, and measure behaviour before and after.
About this report
It uses over 700,000 results of sanctioned phishing emails sent by Keepnet customers in 2018. The data covers 1 January 2018 to 1 January 2019 and was evaluated anonymously.
Results were worse in 2018. Open rates rose from 48.2% to 49.32%, clicks from 31.5% to 33.10%, and submissions from 7.9% to 12.87%.
Quality Management/Health, Purchasing/Administrative and Legal/Audit/Internal Control were the most likely to disclose requested information. Quality Management/Health and Purchasing/Administrative Affairs were also in the top 3 the year before.
Keep reading
The Mobile Phishing Visibility Gap
~40%higher click rate on phone-based simulations than on email (Verizon DBIR 2026).Read the key findings
Cut Human-Driven Incidents: A CISO Playbook for Measurable Behaviour Change
76% vs 60%Most large firms train employees, yet human factors still sit behind most breaches.Read the key findings
2025 New Hires Phishing Susceptibility Report
44%more susceptible to phishing: new hires in their first 90 days compared with tenured employeesRead the key findings
2024 Voice Phishing (Vishing) Response Report
6.5%of 3,279 employees called shared sensitive information during simulated vishing calls.Read the key findings
2020 Phishing Trends Report
50.42%of simulated phishing emails were opened by the target in 2019.Read the key findings
Statistical Analysis of 126,000 Phishing Simulations Carried Out in 128 Companies Around the World
48.2%of simulated phishing emails were opened by the target in 2017.Read the key findings
The State of the Smish Report 2023
74%of organisations experienced a smishing attack in 2021, according to Safety Detectives.Read the key findings
2021 Email Security Vulnerability Report
90.56%of checked malicious test emails reached the target inbox past the security tools in place.Read the key findings
See how Keepnet would act on these findings for you
- Run multi-channel simulationsFrom email through to deepfake.
- See reporting outcomes and the behaviour scoreReporting, repeat behaviour and remediation, in one board report.
- Explore AI agents and automationSee how simulations, training and follow-up can run with less manual work.
Book a 30-minute demo
Thirty minutes, no cost and no obligation.
Thank you, your request is in
A confirmation is on its way to your inbox.
Thirty minutes with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your demo is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tab