Our Q1 2026 sector-anonymised benchmarks are published today on the resources page. The dataset covers 2.4M simulation deliveries across 240 customers in our active EMEA customer base, normalised by sector and organisation size.
Headline figures for reference: aggregate click-rate is 8.1% (down from 9.4% in Q4 2025), aggregate reporting-rate is 31.2% (up from 28.7%), aggregate engagement-rate is 39.3%.
Sector breakdown: financial services is the strongest segment with click-rate at 5.3% and reporting-rate at 41.8%, reflecting the maturity of the sector's awareness programmes and the regulatory pressure on the function. Manufacturing is the weakest with click-rate at 11.2% and reporting-rate at 22.1%; the manufacturing population skews toward operational roles with limited prior exposure to phishing-resilience training.
Organisation-size effects are notable. Customers with 500-2,000 employees show consistently better reporting-rate than customers with 10,000+ employees across all sectors. Our working hypothesis is that smaller organisations have more direct visibility from security teams to the workforce, producing higher engagement with the awareness programme. This is consistent with prior research but new in our specific cohort data.
Vector breakdown: quishing (QR-code) campaigns are now the highest-engagement vector at 22% across the dataset, exceeding pure email at 18%. SMS-based smishing is at 14% and voice-based vishing campaigns at 11%.
Full anonymised data, with cohort drill-downs and statistical-significance markers, is available on the resources page without registration. We publish these benchmarks quarterly and intend to extend the methodology coverage over the next two releases.