Verizon DBIR 2026: What the Human Element Data Means for Security Awareness Programs | NINJIO
Key Takeaways
- Human involvement appeared in 62% of confirmed breaches: This figure has held between 60% and 74% across four consecutive DBIR cycles, a pattern more telling than any single year’s number.
- Phone-centric phishing simulations succeed roughly 40% more often than email phishing: Many simulated phishing programs don’t test for these channels, despite phones accounting for around a quarter of all social engineering vectors.
- Median time from phishing email to credential entry is under 60 seconds: Recognition training helps, but the real gap is the absence of a deliberate pause habit before clicking.
Verizon’s 2026 Data Breach Investigations Report drew on more than 22,000 confirmed breaches across 145 countries, the largest dataset in the report’s 19-year history. Vulnerability exploitation tends to dominate the headlines when the DBIR drops. But for cybersecurity leaders, the human risk numbers are just as important, and considerably harder to solve with a patch.
The DBIR’s findings show a consistent trend: cybercriminals are still waiting for people to slip up. 62% of breaches involved the human element, and social engineering accounted for 16% of breach patterns in the 2026 report, keeping it in the top three for the third year running; the tactics behind it have diversified in ways most cybersecurity awareness training programs haven’t kept pace with.
Has the Human Element in Breaches Remained Stable?
Yes, and the stability across four years is more significant than year-to-year movement.
| Year | Human Element in Breaches |
| 2023 | 74% |
| 2024 | 68% |
| 2025 | 60% |
| 2026 | 62% |
The 2026 DBIR puts human involvement at 62% of confirmed data breaches, up slightly from 60% in 2025. What’s more important here is how stable the numbers have been: the human element has never dropped below 60%.
Why This Matters for Cybersecurity Awareness Program Design
Technology controls address the infrastructure attackers exploit, but they don’t reduce the risk that comes from how individuals respond to social engineering. Cybersecurity awareness training paired with personalized security coaching address that behavioral risk.
How Fast Does a Phishing Attack Lead to Credential Compromise?
Phishing attacks reach credential compromise faster than most cybersecurity professionals would estimate.
Phishing simulation data from the 2024 DBIR puts the median time to click at 21 seconds after opening the email, with credentials entered just 28 seconds after that.
What a Sub-60-Second Window Means for Cybersecurity Awareness Training Programs
Individuals who fall for phishing attacks often aren’t failing from lack of cybersecurity knowledge.
Phishing is engineered to trigger fast, instinctive action before someone can think critically about their decision. Cybersecurity awareness training programs that focus on recognizing suspicious indicators help, but building the habit of pausing before clicking is what closes that window.
People need to know what a social engineering attack feels like, not just what it looks like. Any action taken in under 60 seconds comes from System 1 thinking, or the emotional response. Cybersecurity awareness training needs to address that part of human nature in order to be successful at reducing human risk.
Is Pretexting a Growing Threat?
Yes, and it requires a different training response than phishing. Pretexting is a form of social engineering where an attacker fabricates a convincing scenario to pressure someone into sharing credentials or taking a specific action, usually by impersonating IT support or a trusted colleague over phone or messaging.
Verizon’s 2023 DBIR found that BEC attacks had almost doubled and accounted for more than 50% of social engineering incidents. The 2026 DBIR built on that by adding pretexting as a separately tracked initial access vector, after it showed up repeatedly in high-profile ransomware breaches.
Credential Abuse Across the Attack Chain
Credential abuse was the leading initial access vector in the 2025 DBIR at 22% of breaches. In the 2026 report, that figure sits at 13%, a reduction the DBIR links largely to pretexting being added as a separately tracked vector.
Measured across all breach stages, credential abuse still appears in 39% of cases. Phishing and pretexting attacks frequently end in credential theft, giving attackers the foothold they need to move further into a target organization.
| Phishing | Pretexting | |
| Format | Asynchronous message | Live interaction |
| Attacker behavior | Static lure | Real-time adaptation |
| Decision window | Present | Absent under pressure |
| Training approach | Warning sign recognition | Live voice scenario practice |
Training someone to spot a suspicious email doesn’t prepare them to handle a convincing caller impersonating IT support and requesting credential verification with urgency.
The Pretexting Blind Spot in Email Phishing-Only Cybersecurity Awareness Training Programs
Organizations that cover email phishing without a parallel track for voice-based social engineering are leaving an opening for cybercriminals, particularly given how frequently pretexting now appears as a ransomware initial access method.
Are Voice and SMS Attacks More Successful Than Email Phishing?
Simulation data analyzed in the 2026 DBIR shows that phone-centric attacks succeed at a higher rate than email phishing.
The simulation data puts phone-centric success rates roughly 40% above email and understanding why that difference exists matters as much as the number itself. The scrutiny habits most cybersecurity awareness training programs build around email don’t automatically carry over to phone calls or text messages.
Individuals interact with those channels differently, and cybercriminals are well aware of it.
- Email phishing simulations had a median success rate of 1.4%
- Phone-centric simulations (voice and SMS) came in at around 2%, roughly 40% higher
- Approximately 41% of social engineering breaches involved attack vectors beyond email
- Phones and social media accounted for around a quarter of all social action vectors in social engineering incidents
- Large organizations face a median of 48 SMS-based phishing campaigns per year, roughly one every eight days
That last figure deserves attention from any cybersecurity leaders: a smishing campaign is arriving roughly every eight days. If individuals haven’t been trained and tested on SMS-based attacks, that’s a channel that cybercriminals are actively probing with no trained resistance on the other end.
Verizon’s researchers had trouble finding organizations that run voice or text-based simulation programs, which kept the sample size for that part of the analysis small. That difficulty is a major finding on its own: the attack channel with the higher success rate is the one almost nobody is training for.
Collaboration Platforms and AI-Assisted Lures Are Also Expanding the Attack Surface
The 2026 DBIR documents a specific pretexting pattern where cybercriminals send external chat requests via Microsoft Teams. They impersonate the IT help desk staff to gain remote desktop access while appearing to troubleshoot and conduct the attack from the victim’s own device.
On the AI side, Verizon found that threat actors used AI assistance across a median of 15 distinct attack techniques, with phishing accounting for 44% of AI-assisted initial access attempts. Individuals who have only trained on email templates have no frame of reference.
What Verizon’s 2026 DBIR Means for Cybersecurity Awareness Programs
| 2026 DBIR Finding | Cybersecurity Awareness Training Program Implication |
| Median phishing compromise under 60 seconds | Design the cybersecurity awareness training program to address the emotional reaction that happens first |
| 40% higher success rate for voice/SMS vs. email | Include vishing and smishing scenarios alongside email templates |
| Only 20% of individuals report simulated phishing | Track report rate alongside click rate as a primary resilience metric |
| Pretexting rising as ransomware initial access method | Extend simulations to include multi-step scenarios |
| Human element stable at three of every five breaches | Cybersecurity awareness training remains one of the few controls directly addressing this attack surface |
Keep Pace With How Cybercriminals Are Operating
The human element in breaches has stayed above 60% for four consecutive years, while the channels attackers use to reach people have expanded well beyond email to include voice calls, text messages, collaboration platforms, and increasingly AI-assisted lures. A cybersecurity awareness program that hasn’t kept pace with that expansion is, by definition, leaving some of that exposure untested.
Download the CISO’s Guide to Cybersecurity Awareness Training for a practical framework on structuring a cybersecurity awareness program that addresses the channels and behavioral patterns the 2026 DBIR data highlights.
Frequently Asked Questions
Phish report rates provide a more complete picture than just measuring phishing click rate. The phish reporting rate shows whether individuals are actively escalating threats, which determines how fast a cybersecurity team can contain a live attack.
Phishing gives individuals a window to pause and evaluate a message. However, pretexting puts a live person on the other end applying real-time pressure, so training for it requires voice-based scenarios.
If your simulated phishing program is email-only, you’re testing for the lower-success attack channel. Phone-based attacks succeed at roughly 40% higher rates, and email-only programs won’t reveal where individuals are vulnerable.
Varied simulation exposure across channels is most effective. Individuals who only see email templates don’t develop instincts for voice or text-based lures. Mixing channels and urgency cues builds more durable response habits.
