Your employees are your best — or weakest — firewall.
Every security tool in the world cannot stop a breach that starts with a click. Verizon’s 2026 Data Breach Investigations Report finds that 62% of breaches still involve the human element — someone clicking a malicious link, reusing a password, or being tricked by a convincing email. And the threat is getting sharper: Microsoft’s 2025 Digital Defense Report found that AI-generated phishing emails now achieve a 54% click-through rate, against just 12% for old-fashioned, manually written scams.
No tool catches the click. A trained employee does.
|
|
|
|
| of breaches still involve the human element. Verizon DBIR, 2026 | click-through rate on AI-written phishing — against 12% hand-written. Microsoft, 2025 | fewer simulation failures after a year of ongoing training. KnowBe4, 2026 |
This is one of the few cyber risks training measurably fixes.
| Figure 1 — Phishing-simulation failure rate | Figure 2 — Click-through by how the email was written |
 |
 |
| A 79% reduction, from 42 million simulated tests across 64,000 organizations. KnowBe4, 2026 | AI has removed the tells staff were taught to look for — the bad grammar and the clumsy greeting. Microsoft, 2025 |
The wider evidence
|
|
|
|
| of employees at organizations with structured programs proactively report a real phishing attempt within a year. Hoxhunt, 2026 | is how quickly training benefits wear off without reinforcement — the case for quarterly, not annual. USENIX SOUPS | of breaches begin with stolen credentials — reused or phished passwords, not a technical exploit. Verizon DBIR, 2024 |
|
|
|
|
| in reported US losses to business email compromise: no malware, just a convincing message. FBI IC3, 2024 | lower average breach cost for organizations with extensive employee training. IBM, 2024 | of phishing sites now target mobile, where a small screen makes a link harder to check. Zimperium, 2024 |
What this means for us
One catch: the effect fades — training benefits can wear off within about six months without reinforcement, so a single annual video is not enough. If you have not completed this quarter’s module yet, now is the time. And if something in your inbox looks off, report it — you might be the reason we stop the next breach before it starts.
Reduce your organization’s risk.
info@mctechconsulting.com
mctechconsulting.com
