What people actually do when faced with simulated phishing and ransomware attacks. Primary data from the SMARTFENSE platform, aggregated and anonymized, across a base of 700+ organizations in the region.
The Human Risk Report is a recurring SMARTFENSE study that measures how people in real organizations respond to simulations of phishing, ransomware and other social-engineering vectors. It is built from aggregated, anonymized platform data — no surveys, no self-perception — and lets you compare human risk by country, by sector and over time.
Human risk is the probability that people's behavior leads to a security incident. It is measured through observed conduct (opens, clicks, data submission, reports) and managed with awareness, simulation and continuous remediation.
Yes, and the data shows it clearly. The aggregate click rate fell from 13.8% in 2020 to 7.1% in 2026, a cut of nearly half. Over the same period a reporting culture was born: from 0% in 2020 to 2.8% in 2026. Organizations that sustain their program year after year reduce risk and gain early warnings.
| Year | Sends | Open rate | Click | Report |
|---|---|---|---|---|
| 2020 | 35,000+ | 36.5% | 13.8% | 0.0% |
| 2021 | 110,000+ | 31.1% | 11.2% | 0.5% |
| 2022 | 350,000+ | 43.0% | 9.5% | 0.6% |
| 2023 | 540,000+ | 41.1% | 7.6% | 1.1% |
| 2024 | 620,000+ | 39.2% | 6.9% | 0.9% |
| 2025 | 800,000+ | 40.3% | 7.4% | 1.2% |
| 2026 (partial) | 570,000+ | 47.7% | 7.1% | 2.8% |
2026 includes data through June. The years 2018-2019 are omitted from the table due to a small sample (under 15,000 annual sends) although they are part of the global aggregate.
The 2026 reading is the most revealing of the series. Emails achieve the highest open rate on record (47.7%), consistent with ever better-written lures in the age of AI-assisted phishing, and yet clicks do not follow that rise and reporting doubles. Attacks get better; trained people get better too.
Nine countries exceed 10,000 simulated phishing sends in the dataset. Italy records the highest click rate (10.6%) and Chile the lowest (5.4%). Panama leads the reporting culture (7.5%), followed by Peru (6.8%), both well above the regional average.
| Country | Sends | Open rate | Click | Data submitted | Report |
|---|---|---|---|---|---|
| Italy | 85,000+ | 53.6% | 10.6% | 2.6% | 1.2% |
| Ecuador | 80,000+ | 46.6% | 9.3% | 2.6% | 3.4% |
| Colombia | 70,000+ | 34.2% | 9.2% | 3.3% | 0.6% |
| Peru | 220,000+ | 50.5% | 9.0% | 3.2% | 6.8% |
| Argentina | 1.3M+ | 49.1% | 8.2% | 2.8% | 0.7% |
| Spain | 310,000+ | 34.7% | 8.0% | 2.3% | 1.2% |
| Mexico | 220,000+ | 25.4% | 7.9% | 0.7% | 0.2% |
| Panama | 40,000+ | 21.9% | 5.5% | 1.1% | 7.5% |
| Chile | 620,000+ | 31.3% | 5.4% | 1.5% | 0.7% |
Only countries with 10,000+ sends. Argentina holds the largest sample (1.3M+ sends). Percentages over each country's total sends.
Energy leads the click rate (12.3%) and Transportation records the lowest (4.8%). Insurance combines a high click rate (9.3%) with the best sector report rate (6.1%).
| Sector | Sends | Open rate | Click | Report |
|---|---|---|---|---|
| Energy | 60,000+ | 44.1% | 12.3% | 5.2% |
| Education | 20,000+ | 48.3% | 10.7% | 0.0% |
| ICT | 55,000+ | 40.5% | 9.8% | 1.2% |
| Insurance | 160,000+ | 43.2% | 9.3% | 6.1% |
| Food | 50,000+ | 35.6% | 8.8% | 0.9% |
| Public administration | 110,000+ | 32.3% | 8.1% | 1.5% |
| Services | 990,000+ | 53.5% | 8.0% | 0.4% |
| Banking/Finance | 570,000+ | 31.9% | 7.7% | 2.5% |
| Healthcare | 160,000+ | 48.1% | 6.7% | 0.1% |
| Industrial | 620,000+ | 32.7% | 5.5% | 0.5% |
| Retail | 40,000+ | 27.4% | 5.4% | 4.0% |
| Transportation | 35,000+ | 45.1% | 4.8% | 0.5% |
Only sectors with at least 5 organizations with data (anti-reidentification publication criterion). Percentages over the sector's total sends.
The dataset also records behavior toward educational content. The signal is consistent: when content reaches the inbox, a significant share of the organization completes it.
The figures exclude interactions generated by security software (sandboxes, gateways, scanners, link checkers). SMARTFENSE detects and filters these interactions automatically. In tools without that filtering, clicks and downloads tend to be inflated.
The same data you see on this page, packaged for your committee: presentable charts, extended methodology and an executive summary. We send it to your inbox right away.
In a demo we show you how to measure your organization's human risk with the same methodology as this report, and how to reduce it with a sustained program.