2025 New Hires Phishing Susceptibility Report
Where onboarding risk sits in the first 90 days, and how to lower it before it becomes a habit.
What the data shows
- 71%Average phishing susceptibility of new hires in their first 90 days, across 237 organisations in 2025.See page 4
- 49%Average phishing susceptibility of tenured employees, those past 90 days at the company.See page 4
- 44%Higher susceptibility for new hires than for tenured employees: (71 - 49) / 49.See page 4
- 30%Lower susceptibility once employees pass 90 days, with simulations and training in place: (71 - 49) / 71.Page 5, in the full report
- 36%Higher likelihood of new hires clicking a phishing email in an independent 2024 study (Baltuttis et al.), in line with Keepnet's data.Page 5, in the full report
Start reading
- 1 / 12
- 2 / 12
- 3 / 12
- 4 / 12
Read the other 8 pages
They open right here. You can also download the PDF.
Tap a page to read it full size.
What the report covers
- Executive summary
- Why new hires carry more risk
- Phishing scenarios aimed at new hires
- Findings: the first 90 days
- Six ways to lower new hire risk
- A sample security behaviour and culture programme
- Implementation and business value
- Industry insight from Tesco, Staples and NetFoundry
Who it is for
CISOs and awareness leads who own onboarding and want a risk-based plan for the first 90 days.
Mistakes often happen not from carelessness, but from uncertainty.
How the data was collected
- Sample
- 237 organisations selected at random from a base of 5,000
- Period
- 2025
- Source
- Keepnet platform phishing simulation data, randomised and cross-sector
- Note
- New hires: 90 days or less at the company. Tenured employees: more than 90 days. Phishing susceptibility is calculated as described in Keepnet's platform documentation. How phishing susceptibility is calculated
Cite this report
Keepnet (2025). 2025 New Hires Phishing Susceptibility Report. https://keepnetlabs.com/reports/new-hires-phishing-susceptibility-report
Figures on this page may be quoted with this citation.
Security Awareness Training
Send training matched to role, risk and behaviour, and see behaviour change before and after.
About this report
In Keepnet's 2025 data, new hires in their first 90 days were 44% more susceptible than tenured employees. Average phishing susceptibility was 71% for new hires and 49% for tenured employees.
The report points to four drivers: unfamiliar security processes, information overload during onboarding, eagerness to comply with requests, and security training that starts late.
The report shows three common ones: CEO impersonation asking for a payment, a fake HR portal for onboarding documents, and a vendor invoice request.
Keepnet analysed phishing simulation data from 237 organisations, selected at random from a base of 5,000 and covering several industries. Employees with 90 days or less at the company were compared with those past 90 days.
Keep reading
Cut Human-Driven Incidents: A CISO Playbook for Measurable Behaviour Change
76% vs 60%Most large firms train employees, yet human factors still sit behind most breaches.Read the key findings
The Mobile Phishing Visibility Gap
~40%higher click rate on phone-based simulations than on email (Verizon DBIR 2026).Read the key findings
2024 Voice Phishing (Vishing) Response Report
6.5%of 3,279 employees called shared sensitive information during simulated vishing calls.Read the key findings
The State of the Smish Report 2023
74%of organisations experienced a smishing attack in 2021, according to Safety Detectives.Read the key findings
2021 Email Security Vulnerability Report
90.56%of checked malicious test emails reached the target inbox past the security tools in place.Read the key findings
MSSP Business Model
$1.3 millionis the payroll an in-house team can reach once it staffs its own 24x7 SOC, according to Cipher.Read the key findings
2020 Phishing Trends Report
50.42%of simulated phishing emails were opened by the target in 2019.Read the key findings
Threat Sharing
206 dayswas the average time to detect a breach, according to IBM's 2019 Cost of a Data Breach Report.Read the key findings
See how Keepnet would act on these findings for you
- Run multi-channel simulationsFrom email through to deepfake.
- See reporting outcomes and the behaviour scoreReporting, repeat behaviour and remediation, in one board report.
- Explore AI agents and automationSee how simulations, training and follow-up can run with less manual work.
Book a 30-minute demo
Thirty minutes, no cost and no obligation.
Thank you, your request is in
A confirmation is on its way to your inbox.
Thirty minutes with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your demo is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tab