AI and tech-themed phishing emails achieve 45% click rates in Kaspersky testing

AI and technology lures lead phishing effectiveness

According to research by cybersecurity firm Kaspersky, AI and technology-themed phishing emails achieved the highest click-through rate at 45% during testing. These lures exploit employees' curiosity or urgency around technological updates, making them particularly effective.

Healthcare and insurance-themed phishing emails also proved highly successful, tricking an average of 28% of recipients. One email disguised as a sanitary inspection report reached a staggering 92% click-through rate, highlighting how regulatory or compliance-themed messages can bypass skepticism.

Promotions and HR-themed scams remain effective

Phishing emails framed as promotions or gifts achieved a 24% click-through rate, while those impersonating HR or corporate communications yielded 22%. A notable example involved an email inviting employees to wear their national team’s football jersey for a chance to win a prize, which tricked 66% of recipients.

These findings underscore how social or emotionally engaging content can override caution, even in professional settings.

Training reduces susceptibility but threats evolve

Kaspersky’s research found that regular cybersecurity training and simulated phishing attacks reduced susceptibility from 60% to as low as 5–7%. This demonstrates the effectiveness of ongoing awareness programs in mitigating human error.

However, the rise of generative AI is enabling cybercriminals to create more personalized and convincing phishing emails. Security experts warn that malicious emails are becoming nearly indistinguishable from legitimate communications, increasing the risk for businesses.

Phishing as the top cyber threat to businesses

Phishing remains the most prevalent cyber-incident affecting businesses at all stages of growth, according to Kaspersky. It is also the leading cause of damaging consequences, including data breaches and financial losses.

The research highlights that while tools like email domain verification and skepticism of urgent threats (e.g., 24-hour account suspensions) can help, the sophistication of modern phishing attacks demands a multi-layered defense strategy.

Why healthcare and compliance emails are high-risk targets

Healthcare and compliance-related communications often involve urgent or mandatory actions, making them prime targets for phishing attacks. Employees may feel compelled to act quickly, reducing their ability to spot red flags.

Similarly, HR-themed emails—such as requests for updated personal information or benefits enrollment—can exploit trust in internal processes. The high click rates in these categories reflect how attackers leverage authority and urgency to bypass critical thinking.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This research underscores a stark reality for founders and operators: phishing isn’t just a persistent threat—it’s a evolving one, supercharged by AI and tailored to exploit human psychology. The fact that AI and technology-themed lures are the most effective isn’t surprising, but the 45% click rate is a wake-up call. Employees are more likely to engage with content that feels relevant to their work, and cybercriminals are leveraging that insight with alarming precision.

For startups, this means security training can’t be a one-off onboarding checkbox. The drop from 60% to 5–7% susceptibility after regular training isn’t just a statistic—it’s proof that awareness works. But the rise of generative AI means training must evolve, too. Simulated attacks should mimic the sophistication of real-world threats, not just obvious scams like the "Nigerian prince" emails of the past.

The high effectiveness of healthcare, compliance, and HR-themed phishing emails also highlights a critical blind spot. These departments often handle sensitive data and urgent requests, making them prime targets. Founders should ensure these teams are not just trained but tested, with simulations that reflect the types of attacks they’re most likely to encounter.

Ultimately, this isn’t just about avoiding a data breach—it’s about protecting your team’s trust, your company’s reputation, and your bottom line. Phishing may be the top cyber-incident leading to damaging consequences, but it’s also one of the most preventable. The question for founders isn’t whether they can afford to invest in training and tools, but whether they can afford not to.

Key takeaways

• AI-driven phishing lures are the most effective, so founders should prioritize training employees to recognize AI-generated and technology-themed scams.
• Simulated phishing attacks and regular training can drastically reduce susceptibility—implement these as core components of your security strategy.
• Healthcare, compliance, and HR-themed phishing emails are highly effective; ensure teams in these departments receive targeted awareness programs.
• Generative AI is making phishing attacks harder to detect, so invest in advanced email filtering and verification tools to counter evolving threats.

FAQ

Why are AI and technology-themed phishing emails so effective?

AI and technology-themed phishing emails exploit employees' curiosity or urgency around updates, new tools, or security alerts. The 45% click-through rate suggests these topics feel relevant and timely, reducing skepticism.

How effective is cybersecurity training in reducing phishing risks?

Kaspersky’s research found that regular training and simulated phishing attacks can reduce susceptibility from 60% to as low as 5–7%. This highlights the importance of ongoing awareness programs.

Which industries or departments are most vulnerable to phishing?

Healthcare, compliance, and HR departments are particularly vulnerable, as their communications often involve urgent or mandatory actions. Phishing emails targeting these areas achieved click-through rates of 22% to 92%.

Related on Lazyfounder

• More technology news
• Nearly half of organizations fail cyber resilience tests during attacks