Fast reporting and response critical to fight phishing

1 in 5 employees fell victim to HR-themed emails in phishing study that involved over 80,000 participants.

Update: An earlier version of this press release was published with incorrect information regarding the number of departments in organization C. It has now been updated with the correct number.

Helsinki, Finland – January 27, 2022:
Phishing emails that mimic HR announcements or ask for assistance with invoicing get the most clicks from recipients, according to a new study from cyber security provider F-Secure.

The study, To Click or Not to Click: What we Learned from Phishing 80,000 People, which included 82,402 participants, tested how employees from four different organizations responded to emails that simulated one of four commonly used phishing tactics.

22% of recipients that received an email simulating a human resources announcement about vacation time clicked, making emails that mimic those sent by HR the most frequent source of clicks in the study.

An email asking the recipient to help with an invoice (referred to as CEO Fraud in the report) was the second most frequently engaged with email type, receiving clicks from 16% of recipients.

Document Share (notifications from a document hosting service) and Service Issue Notification (messages from an online service) emails received clicks from 7% and 6% of recipients, making them the least frequently clicked emails in the study.

However, according to Matthew Connor, F-Secure Service Delivery Manager and lead author of the report, the study’s most notable finding was that people working in ‘technical’ roles seemed equally or even more susceptible to phishing attempts than the general population.

Matthew Connor

“The privileged access that technical personnel have to an organization’s infrastructure can lead to them being actively targeted by adversaries, so advanced or even average susceptibility to phishing is a concern,” Connor explained. “Post-study surveys found that these personnel were more aware of previous phishing attempts than others, so we know this is a real threat. The fact that they click as often or more often than others, even with their level of awareness, highlights a significant challenge in the fight against phishing.”

Out of the two organizations studied with personnel working in IT or DevOps, both clicked test emails at rates that were either equal to or higher than other departments in their organizations: 26% from DevOps and 24% from IT compared to 25% for one organization, and 30% from DevOps and 21% from IT compared to 11% for the other organization.

Furthermore, the study found that these departments were no better at reporting phishing attempts than others. In one organization, IT and DevOps came third and sixth out of nine departments in terms of reporting. In the other organization, DevOps was the twelfth best at reporting out of sixteen departments, while IT was fifteenth.

The value of a fast, easy-to-use reporting process was also highlighted in the report. In the first minute after the test emails arrived in inboxes, over three times the number of people who reported it as suspicious had clicked. This number leveled out at around five minutes and stayed consistent after that.

And while reporting became more common as time went on, the different processes at different organizations played a key role. 47% of participants from an organization that provided all employees with a dedicated button to flag suspicious emails used it during the study. Only 13% and 12% of participants from two other organizations reported their test emails (the remaining organization did not provide data on reporting).

According to F-Secure Director of Consulting Riaan Naude, the patterns in report and click rates identified by the study highlights a practical opportunity for organizations to mobilize employees in a collective effort to protect themselves against phishing.

Riaan Naude

“The evidence in the study clearly points to fast, painless reporting processes as common ground where security personnel and other teams can work together to improve an organization’s resilience against phishing. Getting this right means that an attack can be detected and prevented earlier, as security teams may only have a few precious minutes to mitigate a potential compromise,” said Naude.  

More information on solutions that help organizations address phishing and other security challenges is available at

About F-Secure

F-Secure makes every digital moment more secure, for everyone. We deliver brilliantly simple, frictionless security experiences that make life easier for the tens of millions of people we protect and our 170 service provider partners. For more than 30 years, we’ve led the cyber security industry, inspired by a pioneering spirit born out of a shared commitment to do better by working together. | |

F-Secure media relations

Adam Pilkey

PR Content Manager

+358 40 637 8859

Press list

Sign up for media information from F-Secure.

We process the personal data you share with us in accordance with our Corporate Business Privacy Policy.

Press archive

By year

Browse through our news by year.

By category

Browse through our news by category.