KnowBe4,a leading risk management solutions provider, recently released its Q2 2025 Simulated Phishing Roundup report. The roundup highlights a continued trend of employee susceptibility to social engineering techniques that exploit familiarity and trust.
Internal communications and well-known brands made up 98 percent of top email subject lines. Additional findings included:
Internal-themed topics made up 98.4 percent of the top 10 most-clicked email templates. Among these, HR was cited in 42.5 percent of phishing failures and IT in 21.5 percent.
71.9 percent of malicious landing page interactions involved branded content. Microsoft was the most common, accounting for 26.7 percent, followed by LinkedIn, X, Okta, and Amazon.
80.6 percent of the top 20 clicked links came from internally-themed simulations.
68.2 percent of these used domain spoofing techniques.
PDF attachment clicks rose by 8.1 percent, compared to Q1.
PDFs comprised 61.1 percent of the top 20 attachments, followed by HTML files (20.9 percent) and Word documents (18.0 percent).
“One of the key takeaways ... is the critical role trust plays in cybersecurity,” said Erich Kron, cybersecurity advocate, KnowBe4. “Whether that is trust in internal communications, familiar brands, or even known individuals, phishing emails that appear to originate from reputable sources will always have a higher chance of lowering a recipient’s suspicions.
"We see this time and time again in real-word scenarios, where attackers use sophisticated social engineering tactics to take advantage of this fundamental human instinct, making it harder for employees to distinguish legitimate and malicious emails.
“The Q2 findings reinforce the need for organizations to strengthen their human defenses through a layered approach centered on human risk management. This includes employee empowerment through a combination of relevant, timely and adaptive security training and intelligent detection technology that can identify and mitigate threats in real time.”
The report is available for download here.
