More than half of bank CEOs, senior executives and directors focus on staff education and training to combat fraud.

For large organisations, the average Phish Prone Percentage (PPP) after one year of sustained training dropped to 4.9%.

After 90 days of training and simulated phishing tests, the Phish Prone Percentages (PPPs) for the education sector reduced to 19%, 19.4%, and 18% respectively for small, medium, and large organisations.

After one year or more of sustained training, the average Phish Prone Percentage (PPP) for small institutions dropped dramatically to 3.9%.

For medium sized organisations, the average Phish Prone Percentage PPP after one year of sustained training dropped to 5.2%.

Difficulty in tuning, training, and supervising AI was an obstacle to the effective use of AI for 39% of respondents

Cost-saving measures reported by CISOs include reduced security solutions and tools (50%), security hiring freezes (40%), and decreased or eliminated security training (36%).

Only 51.2% of organisations now offer basic security training, which is the lowest rate observed since the BSIMM initiative began in 2008.

47% of respondents indicated a lack of training or poor training as a common privacy failure.