News
Phishing Isn't an Email Problem Anymore - It's an Identity Problem
Security teams have invested heavily in email protection, endpoint security and identity controls, but Fortra's latest research suggests one challenge remains difficult to solve: users.
The company's 2025 Phishing Simulation Benchmark Report analyzed 14 million simulated phishing recipients across more than 7,500 campaigns to examine employees' responses to phishing attempts.
The findings highlight a persistent challenge for enterprise security teams: attackers continue to target people because compromised accounts can provide direct access to corporate environments.
Across the simulations analyzed, Fortra found a 5.42 percent click rate and a 1.99 percent password submission rate, showing that convincing phishing attempts can still persuade users to interact with malicious content.
The report also found that phishing reporting remains a challenge. Only 10.5 percent of users reported simulated phishing emails, meaning many potential threats could go unnoticed without additional security controls.
For Microsoft administrators, the findings reinforce why identity security has become central to modern defense strategies.
As organizations move more applications and data into Microsoft 365 and cloud environments, stolen credentials can provide attackers with a path into sensitive systems without requiring malware or traditional exploits.
Multifactor authentication, conditional access policies, user training and identity monitoring can all help reduce risk, but Fortra's research suggests technology alone is not enough.
The report argues that phishing defense requires organizations to treat employees as part of the security perimeter - - not simply as potential victims.
"The modern phishing ecosystem is no longer defined by isolated scams, but by rapidly evolving criminal platforms that continuously adapt to defensive improvements," Fortra said.
For enterprises, the challenge is clear: blocking phishing attacks requires more than stronger email filters. It requires building a security culture where users recognize threats, report suspicious activity and become another layer of defense.