New Employee Phishing Click Rate Benchmarks: First 90 Days vs. Tenured Staff Performance

Security awareness programs invest substantial effort in annual training, quarterly refreshers, and monthly phishing simulations for established employees. Most programs invest far less in security onboarding for new hires—the employee population with the highest phishing vulnerability and the shortest organizational tenure.

Industry data reveals that new employees in their first month click phishing simulations at rates 1.8x to 2.5x higher than tenured employees in the same organization. An organization with an established employee click rate of 20 percent commonly shows new hire click rates of 38 to 45 percent during the first four weeks of employment. That vulnerability gap represents a massive, predictable, and largely unaddressed security exposure.

The new employee vulnerability is not permanent. Click rates decline substantially over the first 90 days as new hires become familiar with organizational communication patterns, complete security training, and develop relationships with colleagues that provide context for evaluating unexpected emails. By the end of the first quarter, most new employees perform at or near organizational baseline. But the window of maximum vulnerability—the first month—is precisely when most organizations provide minimal security guidance beyond generic "complete this training module" assignments.

This guide provides detailed new employee phishing click rate benchmarks across the first-day, first-week, first-month, and first-quarter onboarding periods, explains the structural and behavioral factors that create new employee vulnerability, and offers a framework for designing security onboarding that addresses the actual risk curve rather than treating new employees as if they were established staff who simply need training completion.

This approach aligns with the NIST SP 800-50 guidelines for building effective information technology security awareness and training programs.

---

The First-Week Vulnerability: Learning Communication Patterns in Real Time

New employees in their first week show the highest phishing click rates, typically ranging from 42 to 55 percent across organizations. The elevation compared to established employees reflects several factors that converge during the initial onboarding period.

Lack of organizational context. New employees do not yet know what normal organizational communication looks like. They have not learned which types of emails are routine, which sender addresses are legitimate internal contacts, which external senders are trusted partners, or which requests are standard procedures versus unusual. Established employees apply pattern recognition accumulated over months or years—they recognize that a particular email is unusual for their organization even if they cannot articulate exactly why. New employees lack that accumulated pattern library.

Expectation of onboarding communications. New hires expect to receive numerous emails during onboarding: IT system access instructions, benefits enrollment notifications, facility access procedures, training module assignments, introductions from new colleagues, and administrative setup tasks. This expectation of legitimate onboarding emails creates vulnerability—attackers time phishing to coincide with the onboarding period and craft messages that impersonate expected onboarding communications.

Relationship ambiguity. New employees have not yet established relationships with colleagues, managers, IT support, HR personnel, and other internal contacts. An established employee who receives an unexpected email from their manager recognizes whether the communication style matches past interactions. A new employee who has met their manager once cannot make that judgment. The lack of established relationships makes it difficult to distinguish between legitimate unexpected communications and suspicious ones.

Credential and system setup vulnerabilities. The first week typically involves extensive credential creation, system access setup, and platform onboarding. New employees enter passwords into numerous new systems, accept multiple new account invitations, and click links in legitimate IT setup emails. The volume of legitimate credential and access activity creates habituation that attackers exploit by inserting credential harvesting attempts into the stream of legitimate setup communications.

Professional socialization pressure. New employees are motivated to demonstrate competence, responsiveness, and cooperation. An email that appears to be from HR requesting immediate completion of a compliance form or from IT requesting immediate password verification creates pressure to comply quickly rather than questioning legitimacy. The desire to make a good impression and to demonstrate professional responsiveness creates vulnerability that attackers exploit.

Organizations that measure new employee click rates during the first week consistently find elevation of 2x to 2.5x compared to established employees. An organization where established employees click at 18 percent typically sees first-week new hire click rates at 40 to 48 percent. The gap is consistent across industries and organization sizes.

---

Healthcare: Highest New Employee Vulnerability, Clinical Onboarding Challenges

Healthcare organizations show the widest gap between new employee and established employee click rates across industries. New healthcare employees in their first month show click rates typically ranging from 45 to 58 percent, compared to established healthcare employee click rates of 25 to 32 percent.

The extreme new employee vulnerability in healthcare reflects the complexity of healthcare onboarding. Clinical staff must learn numerous systems—EHR platforms, patient communication systems, medication management tools, scheduling systems, clinical documentation platforms—each generating legitimate onboarding emails and access notifications. The volume of legitimate system onboarding creates abundant opportunities for attackers to insert credential harvesting attempts.

Healthcare also hires in high volume with short onboarding timelines. A hospital adding 50 nurses for a new unit cannot provide extensive individual onboarding—orientation happens in group sessions, system training happens through brief modules, and new clinical staff are expected to become functional quickly. The compressed onboarding creates periods where new employees are simultaneously learning multiple new systems and beginning patient care responsibilities, creating maximum cognitive load and minimum capacity for careful email scrutiny.

Travel nurses, contract clinical staff, and temporary healthcare workers face even more extreme vulnerability. These employees may work at a facility for only 13 weeks and may work at multiple facilities in succession throughout the year. They lack the organizational tenure to develop pattern recognition for facility-specific communication, and they experience continuous onboarding as they rotate through assignments. Healthcare organizations with substantial contract staff populations show elevated organizational click rates driven largely by the continuous presence of new, high-vulnerability temporary employees.

Healthcare organizations that achieve new employee click rates below 35 percent in the first month typically do so through combination of structured onboarding security training and technical controls. The onboarding training happens in the first days of employment rather than being assigned as a module to complete within 30 days. The training teaches healthcare-specific phishing patterns—fake EHR notifications, fake patient portal alerts, fake prescription system messages—rather than generic phishing scenarios. The technical controls include restricting new employee email access until after security orientation and implementing heightened email filtering for accounts less than 30 days old.

---

Financial Services: Moderate New Employee Gap, Regulatory Training Infrastructure

Financial services organizations show new employee click rates typically ranging from 30 to 42 percent in the first month, compared to established employee click rates of 18 to 25 percent. The gap is smaller than healthcare but still represents substantial vulnerability.

Financial services new employee vulnerability is moderated by several factors. The sector has mature onboarding training infrastructure driven by regulatory compliance requirements. New employees in financial services typically complete extensive compliance training in their first weeks, and security awareness is often integrated into that compliance training rather than treated as separate optional content.

Financial services organizations also tend to have more structured onboarding processes than other industries. New hires in banks, investment firms, and insurance companies often go through formal training programs that include security orientation. The structured programs create opportunities to deliver security training early in tenure rather than assuming new employees will complete assigned training modules independently.

However, financial services new employees still show elevated vulnerability compared to established staff because the factors that create new employee vulnerability—lack of organizational context, unfamiliarity with communication patterns, relationship ambiguity—are not fully addressed by completion of training modules. A new financial services employee who completes comprehensive security training in week one still lacks the accumulated pattern recognition that established employees apply when evaluating suspicious emails.

The financial services roles that show highest new employee vulnerability are client-facing positions: wealth advisers, relationship managers, and sales staff who begin extensive external communication immediately upon hire. These employees receive high volumes of external emails from day one and lack the organizational tenure to distinguish between expected external communications and suspicious ones. Their first-month click rates often reach 40 to 50 percent even when back-office new employees show click rates of 25 to 30 percent.

Financial services organizations that achieve new employee click rates below 25 percent in the first month typically do so through combination of early comprehensive training and technical controls that restrict access during highest-risk periods. Some organizations delay full email access until after security training completion. Others implement heightened email filtering and limit external email delivery to new employee accounts during the first 30 days.

---

Technology: Smallest New Employee Gap, Technical Baseline Advantage

Technology sector organizations show the smallest gap between new employee and established employee click rates across industries. New technology employees in their first month show click rates typically ranging from 24 to 35 percent, compared to established employee click rates of 15 to 22 percent.

The smaller gap reflects several technology sector characteristics. New hires in technology companies often have strong baseline security awareness from previous employment in technology roles. An engineer joining a new technology company brings security knowledge from their previous employer, reducing the learning curve compared to industries where new employees may be entering technology-intensive work environments for the first time.

Technology sector onboarding also tends to be more technical and self-directed than other industries. New hires are often given access to internal documentation, wiki systems, and communication platforms on day one and are expected to learn through exploration and colleague interaction rather than through formal structured training. This self-directed onboarding creates earlier exposure to actual organizational communication patterns compared to industries where formal structured onboarding delays practical exposure.

However, technology sector new employee vulnerability still exists and concentrates in specific populations. Non-technical new hires in technology companies—joining sales, marketing, HR, and administrative roles—show first-month click rates of 38 to 48 percent, comparable to non-technology industries. The technology sector's smaller overall new employee gap is driven primarily by the technical employee population rather than representing superior onboarding for all roles.

Technology startups and high-growth companies also show elevated new employee vulnerability because high hiring velocity creates continuous large populations of new employees. An organization adding 20 percent headcount quarterly maintains a persistent population where roughly 15 to 20 percent of employees are in their first 90 days at any given time. The continuous presence of high-vulnerability new employees elevates organizational aggregate click rates even when established employee performance is strong.

Technology organizations that achieve new employee click rates below 20 percent in the first month typically do so through technical employee onboarding that integrates security into engineering bootcamp processes and through use of employee referrals that create immediate social connections providing context for evaluating communications. New employees who join with existing relationships to current employees have natural sources for verifying unexpected communications that new employees without internal connections lack.

---

Education: Highest New Employee Turnover, Continuous Vulnerability

Educational institutions show new employee click rates typically ranging from 42 to 55 percent in the first month, comparable to healthcare, but education faces an additional challenge: extremely high new employee turnover that creates continuous populations of high-vulnerability employees.

K-12 school districts experience substantial teacher turnover, with many districts seeing 15 to 25 percent annual turnover rates. Universities experience high turnover in adjunct faculty, student employees, and administrative staff. The continuous influx of new employees means that at any given time, 10 to 20 percent of the workforce may be in their highest-vulnerability first 90 days.

Educational new employee onboarding typically provides minimal security training. K-12 teachers beginning employment in August before the school year starts receive extensive curriculum training, classroom management guidance, and administrative procedures orientation but often receive minimal or no security awareness training. University faculty and staff onboarding similarly prioritizes academic and administrative content over security.

The educational work environment also normalizes continuous new employee presence in ways that create security vulnerability. Students cycle through annually, student employees turn over each semester, adjunct faculty rotate through courses, and graduate students transition in and out of teaching and research roles. The continuous presence of new people in the environment makes it difficult to identify whether someone is legitimately new or impersonating a new member of the community.

Educational institutions that achieve new employee click rates below 35 percent typically do so by integrating brief security awareness content into mandatory HR onboarding that all new employees complete in their first week. The training is delivered in short video format that can be completed in 10-15 minutes and focuses on the most common phishing patterns targeting education: fake IT password reset requests, fake student information system notifications, and fake building access or parking instructions. The brevity allows integration into existing onboarding without extending onboarding timelines that education budgets cannot support.

---

Government and Public Sector: Variable Onboarding, Political Appointment Challenges

Government organization new employee click rates show substantial variation by employment type and onboarding process. Career civil service new hires typically show first-month click rates of 32 to 45 percent. Political appointees and senior officials often show first-month click rates of 45 to 60 percent.

Career civil service onboarding in federal agencies typically includes structured security training driven by FISMA and other cybersecurity requirements. New federal employees often complete security awareness training within their first week, reducing the window of maximum vulnerability. State and local government onboarding is more variable—some jurisdictions provide structured security onboarding while others provide minimal training.

Political appointees and senior officials face unique vulnerabilities. These individuals often begin roles with immediate high-level responsibilities, extensive external communication requirements, and access to sensitive information before completing standard security training. They also face immediate targeting by sophisticated attackers who understand that senior officials in their first weeks have maximum access and minimum organizational familiarity.

The public availability of government hiring information creates additional new employee targeting vulnerability. Government hiring processes often involve public job postings, public hiring announcements, and public records of new employee start dates. Attackers can identify new government employees and time phishing to coincide with their onboarding period more easily than in private sector organizations where hiring information is not publicly available.

Government organizations that achieve new employee click rates below 30 percent typically do so through mandatory first-week security training that precedes system access provisioning and through technical controls that restrict email access until training completion. Federal agencies with mature security programs often require security clearance holders to complete security refresher training when changing positions even within the same agency, recognizing that changing roles creates new employee-like vulnerability even for established government employees.

---

Retail and Hospitality: Seasonal Surge Vulnerability

Retail and hospitality organizations face extreme new employee vulnerability concentrated during seasonal hiring periods. Organizations that hire thousands of seasonal employees for holiday retail periods, summer tourism seasons, or major event staffing show organizational click rate spikes that directly correlate with new hire onboarding waves.

New retail and hospitality employees in their first month show click rates typically ranging from 48 to 62 percent, the highest across industries. The extreme vulnerability reflects minimal onboarding security training, immediate customer service pressure, and high cognitive load from learning numerous operational procedures simultaneously.

Seasonal employees face even more extreme vulnerability than permanent new hires. Seasonal workers receive abbreviated onboarding focused on immediate operational competence—point-of-sale system operation, customer service procedures, inventory handling—with minimal security content. Many seasonal employees work only 8-12 weeks and leave employment before completing any security training beyond what was delivered in the first days of employment.

The volume of seasonal hiring creates security program challenges that most retail and hospitality organizations have not addressed effectively. An organization hiring 3,000 seasonal employees over a six-week period cannot provide individualized security onboarding to that population. Group onboarding sessions prioritize content required for immediate job function, and security awareness is rarely considered essential for immediate function.

Retail and hospitality organizations that achieve new employee click rates below 40 percent during seasonal hiring periods typically do so through brief mandatory video training that can be completed in 5-10 minutes during onboarding and through technical controls that restrict new employee email access. Many retail organizations provide seasonal employees with limited email accounts that can receive but not send external email and that have heightened filtering, reducing both phishing exposure and the damage from successful compromise.

---

The Onboarding Timing Problem: When Training Happens vs. When Vulnerability Peaks

Industry data reveals a critical mismatch between when new employee phishing vulnerability peaks and when security training is typically delivered. Vulnerability is highest in week one and declines substantially by week four. Security training is typically assigned in week one but completed (if at all) in weeks two through four.

Organizations that assign security awareness training modules to new employees on day one with 30-day completion windows are delivering training after the highest-risk period has passed. A new employee who clicks phishing in week one and completes assigned security training in week three has experienced their security failure before receiving the training designed to prevent it.

The solution is shifting security training from assigned completion to immediate delivery. Organizations that provide 15-20 minutes of security orientation in the first days of employment—before providing full email access, before provisioning system accounts, before the employee begins independent work—achieve new employee click rates 15 to 25 percentage points lower than organizations that assign training for later completion.

The immediate security orientation does not need to be comprehensive—it needs to address the specific vulnerabilities of the first-week period. Teaching new employees to verify unexpected emails requesting credentials, to recognize that urgent requests during onboarding may be phishing, and to know how to contact IT or security with questions provides sufficient guidance to reduce first-week vulnerability substantially.

Comprehensive security training can still happen later in onboarding, but the critical intervention is brief, immediate, practical guidance delivered before vulnerability peaks rather than extensive training delivered after peak vulnerability has passed.

---

The Ninety-Day Convergence: When New Employees Reach Baseline

New employee phishing click rates decline substantially over the first 90 days, converging toward organizational baseline by the end of the first quarter. The timeline of vulnerability decline is consistent across industries despite variation in absolute rates.

Week one: 2.2x to 2.5x baseline click rate. New employees show maximum vulnerability.

Week four: 1.6x to 1.9x baseline click rate. Substantial improvement from week one but still elevated.

Week eight: 1.3x to 1.5x baseline click rate. Approaching baseline but measurably elevated.

Week twelve: 1.1x to 1.2x baseline click rate. Near baseline, residual elevation reflects incomplete integration.

Month six: At or below baseline click rate. New employees perform comparably to or better than established employees, possibly because recent training completion keeps security awareness active.

The convergence timeline suggests that organizational integration—learning communication patterns, establishing colleague relationships, accumulating experience with legitimate organizational communications—matters more than formal security training completion. New employees who complete comprehensive security training in week one still show elevated click rates in week four because they lack the organizational context that training cannot provide.

The implication for program design is that reducing new employee vulnerability requires both early training and accelerated organizational integration. Organizations that assign new employees to teams immediately, that facilitate rapid relationship building through structured introductions and mentorship, and that provide clear guidance on how to verify unexpected communications achieve faster vulnerability decline than organizations where new employees remain socially isolated through extended onboarding periods.

---

The Turnover-Vulnerability Connection: Why High-Turnover Organizations Show Elevated Risk

Organizations with high employee turnover maintain continuous populations of high-vulnerability new employees, creating persistently elevated organizational click rates that aggregate metrics attribute to poor security culture when the actual driver is continuous new employee influx.

An organization with 25 percent annual turnover maintains a population where approximately 6 to 8 percent of employees at any given time are in their highest-vulnerability first month. Even if established employees perform well, the continuous presence of high-vulnerability new employees elevates organizational aggregate click rates.

Retail, hospitality, healthcare (particularly contract clinical staff), and K-12 education all combine high baseline phishing vulnerability with high turnover, creating compounding security challenges. These industries show the highest organizational click rates across benchmarks, and new employee vulnerability contributes substantially to that elevation.

Organizations in high-turnover industries that achieve click rates comparable to low-turnover industries typically do so through investment in new employee security onboarding that other organizations would consider excessive. Providing immediate brief security orientation to every new hire, maintaining heightened email filtering for accounts less than 90 days old, and implementing technical controls that restrict new employee access create operational friction but meaningfully reduce the vulnerability that high turnover creates.

---

Using New Employee Benchmarks to Improve Onboarding

Understanding how your new employee click rates compare to benchmarks and how they change over the first 90 days should inform several specific program changes.

If your first-month new employee click rate is above 40 percent, the immediate opportunity is implementing brief immediate security orientation in the first days of employment before vulnerability peaks. Waiting to deliver training until week two or week three means delivering training after the highest-risk period.

If your new employee click rate remains elevated beyond 90 days—showing 1.3x or higher baseline after three months—the issue is likely insufficient organizational integration rather than insufficient training. New employees who remain socially isolated or who lack clear channels for verifying unexpected communications continue showing elevated vulnerability because they lack organizational context. The solution is accelerating integration through mentorship, team assignment, and explicit guidance on verification procedures.

If your new employee vulnerability varies significantly by role—with some roles showing 50+ percent first-month click rates and others showing 25 to 30 percent—the variation likely reflects differences in onboarding quality, immediate work demands, or external communication requirements. Role-based analysis often reveals that customer-facing, field-based, or operational roles receive less security onboarding than desk-based information worker roles despite facing equal or greater phishing exposure.

If your organization has high turnover—20+ percent annually—and your aggregate click rate is elevated compared to industry benchmarks, the question is whether the elevation is driven by continuous new employee vulnerability or by poor established employee performance. Segmenting metrics by tenure often reveals that established employees perform adequately but that continuous new employee influx elevates organizational averages. The solution is investing in new employee onboarding rather than intensifying training for established employees who are not the primary vulnerability source.

---

PhishSkill tracks click rates by employee tenure in every simulation, revealing whether elevated organizational vulnerability is driven by continuous new hire influx or by established employee behavior—and showing the exact timeline of vulnerability decline through the first 90 days. Because security programs that ignore new employee vulnerability windows are failing during the period of maximum risk regardless of how well established employees perform.

Related Reading

New employee vulnerability is part of the broader onboarding challenge. For the complete security culture context that affects new employees, see Security Culture Measurement for CISOs. For the department-specific patterns that affect where new employees land, read Phishing Click Rate Benchmarks by Department. To understand how new employee vulnerability fits into comprehensive program measurement, see Phishing Resilience Score.