Phishing emails dressed up as AI announcements are now among the most convincing traps in the workplace. New data from the Kaspersky Automated Security Awareness Platform (KASAP) phishing simulator shows that tech and AI-themed lures drew a 45% click rate, while one healthcare-related email fooled a staggering 92% of recipients.
The findings show that emotionally charged and topical emails remain the hardest for employees to spot as fake, and why ongoing cyber awareness training matters for organisations of every size.
Why Phishing Emails Remain a Top Business Threat
In 2026, phishing is the most common cyber incident for businesses at any stage of growth. It also ranks top among incidents that lead to damaging business consequences.
Human-targeted attacks are becoming more sophisticated, faster and broader in scope. Attackers are shifting to multi-stage campaigns, now heightened by AI-driven techniques.
To find the most convincing patterns, Kaspersky analysed anonymised, voluntarily provided data from its Phishing Simulator. The tool lets administrators safely test employee vigilance with realistic, unannounced simulations. A high click rate clearly shows what training is needed.
5 Types of Phishing Emails Employees Fall For Most
1. Tech and AI Themes: 45% Click Rate
Tech and AI-themed templates, such as “Introducing next-generation artificial intelligence”, were the most convincing of all, generating a 45% click rate among test recipients.
2. Healthcare and Insurance: 28%
Healthcare and insurance phishing emails tricked an average of 28% of recipients. Notably, emails about a sanitary inspection report reached a 92% click rate.
3. IT Policies and Compliance: 26%
Phishing emails centred on IT policies and compliance drove clicks from 26% of employees. One simulation involving an approval request tricked nearly half of all recipients (48%).
4. Gifts, Promotions and Tickets: 24%
Gift and promotion emails seemed trustworthy to 24% of the audience. Lures tied to major events did even better: a FIFA-themed “Wear the national team jersey — win prizes!” campaign captured a 66% click rate. Fake rewards are a familiar tactic, as seen in earlier phishing scams with fake giveaways.
5. HR and Corporate Communications: 22%
Phishing that mimicked HR and corporate messages lured 22% of employees. Emails on sensitive, high-interest internal topics were especially dangerous, such as surveys on company operations or notices about a mandatory dress code.
Generative AI Is Making Phishing Emails More Personal
People naturally respond to sensitive and highly contextual emails, especially when phishing mimics their exact workflow or local specifics. Knowing this, cybercriminals make their traps more personalised and this trend is set to accelerate with the rise of generative AI.
Svetlana Kalashnikova, Security Awareness Expert at Kaspersky
The good news is that cyber vigilance can be trained. Kalashnikova noted that it delivers measurable risk reduction: “regular training and attack simulations drastically reduce phishing susceptibility rates from 60% to a mere 5–7%, according to KASAP effectiveness analytics.” She strongly recommends that organisations run an ongoing cybersecurity awareness programme for all employees.
New KASAP Plans for Every Business Size
Kaspersky is launching new KASAP plans, backed by nearly 30 years of cybersecurity expertise, to suit different budgets and needs. All three include integrated phishing simulations that teach staff to recognise phishing emails, while the Phishing Simulator is also offered as a standalone solution for Managed Service Providers (MSPs).
- KASAP Essential: Built for small and medium organisations, it develops core cybersecurity skills and supports compliance through easy-to-manage training.
- KASAP Proactive: Continuous, proactive training and measurement, best suited to companies with 1,000+ employees.
- KASAP Advanced: For enterprises with a mature security culture and regulated industries, with tools to build customised awareness programmes on-premises or in the cloud.
Organisations can request a free trial and evaluate their current cybersecurity culture at the official KASAP website. Smaller firms can also explore these tips to strengthen SME cybersecurity.
About the Data
The statistics are based on over 150,000 simulated phishing emails sent to employees across 120 countries between January and September 2026. Not every template was sent to every employee, and the data covers only templates sent to more than 100 users.
