Emotionally charged and topical phishing emails remain the hardest for employees to recognise as fraudulent, with one simulated insurance-themed lure reaching a 92 per cent click rate, according to new data from Kaspersky‘s Automated Security Awareness Platform (KASAP).

The findings, drawn from more than 150,000 simulated phishing emails sent to employees across 120 countries between January and September 2026, found that technology and AI-themed templates were the most convincing category overall, generating a 45 per cent average click rate among test recipients.

Healthcare and insurance lures prove most dangerous

Healthcare and insurance-themed emails tricked an average of 28 per cent of recipients, but one simulation involving a rejected insurance claim reached a 92 per cent click rate. IT policy and compliance-themed emails averaged 26 per cent, with a fake approval request fooling nearly half of all recipients tested.

• Gifts, promotions and tickets lures averaged 24 per cent, with a FIFA-themed “win prizes” campaign reaching 66 per cent.
• HR and corporate communications lures averaged 22 per cent, with internal surveys and dress-code notices among the most effective.

Training can cut susceptibility sharply, Kaspersky says

“People naturally respond to sensitive and highly contextual emails, especially when phishing mimics their exact workflow or local specifics. Knowing this, cybercriminals make their traps more personalised, and this trend is set to accelerate with the rise of generative AI,” said Svetlana Kalashnikova, security awareness expert at Kaspersky.

Kalashnikova added that regular training and attack simulations can reduce phishing susceptibility rates from around 60 per cent to as low as 5 to 7 per cent, based on KASAP’s effectiveness analytics. Kaspersky has launched new KASAP tiers — Essential, Proactive and Advanced — aimed at bringing scalable cyber-defence training to organisations of all sizes.