If any team should be phishing-proof, it is IT. Yet across a year of simulations, our data showed that 30.27% of Tech Development staff and 28.53% of IT staff clicked at least one simulated phishing email.
That is a cumulative figure, counting anyone who clicked at least once across a year of tests rather than routine behaviour. On any single simulation very few click, but given enough realistic attempts, even the most knowledgeable people can slip.
For some, it went beyond the click. Over the year, 11.56% of Tech Development and 11.48% of IT staff entered their credentials.
We’d like to think our simulations are simply that convincing. But the finding is a reminder that knowing what to look for doesn’t guarantee you’ll spot it every time.
Why even IT can click
IT and development teams know what to look for in a phishing email. But knowing the signs and spotting them on a busy Tuesday, mid-task, on autopilot, with a hundred other things open, are two different things. In that moment, even the most cyber-literate person in the building can miss the warning signs and click.
The same pressures affect people across the business. Finance, operations and sales teams have their own priorities, and phishing isn’t necessarily front of mind as they work through their day. Cybersecurity knowledge helps, but it doesn’t eliminate the risk of someone being taken by surprise by a convincing email.
What it means for your business
That makes the common view of phishing, as a problem of a careless few, hard to sustain. The question is not which department is the weak link, but whether any part of your business can be assumed protected without a programme at all.
The data suggests not. If even your most capable people click, and some hand over credentials, no part of the business is safe to leave without one. And it works best as a programme that keeps going, not a once-a-year exercise.
Download the full Phishing Behaviour Report 2026 to see how behaviour varies across teams and departments, and where the risks sit in businesses like yours.
Want to see how adaptive simulations can help your whole workforce put security knowledge into practice? Email contact@pistachioapp.com to book a 15-minute demo.
