The ESI Benchmark Report 2023 evaluates roughly 1.8 million simulated spear phishing attacks run between May 2019 and June 2022 across about 140,000 users at 350 companies to measure and improve employee security behavior using Hornetsecurity’s patented Employee Security Index (ESI), a 0–100 benchmark based on phishing difficulty and attacker “success rates.” It finds organizations typically reach an acceptable ESI level of 70 after around three months of training, but maintaining that level requires continuous, regularly updated simulations, since learning fades and new hires reset risk. The report shows the “bottom 20%” of users never reach ESI 70 with one-size-fits-all training, that even a one-month training pause can reduce ESI by five points (and four months by 30+), and that authori

Join for free to read