197 views
Photo by Markus Winkler on Pexels

Over 30% of employees open phishing emails, higher than global average

Internal communication phishing emails had the highest click rate.

The results of Singapore's first coordinated phishing exercise held as part of Exercise SG Ready (ESR) 2025 have revealed that more than 30% of the phishing emails were opened and 17% of the recipients clicked the phishing link, 8% higher than the average global phishing rate.

This suggests that a significant number of employees may be susceptible to real-world phishing attacks.

Additionally, approximately 5% of employees reported a phishing attempt, which is 13% lower than the global industry reporting rate of 18%.

According to the Singapore Business Federation (SBF), this underscores the need for enhanced security awareness and reporting protocols.

The click rates between large companies and SMEs were closely tied, indicating that both large and small companies are equally susceptible to phishing attacks.

Amongst the different types of phishing emails sent, those on internal communications garnered the highest click rate, suggesting that employees generally were less guarded about the authenticity of emails claiming to originate from within the organisation.

Join Singapore Business Review community
Join Singapore Business Review community
A NOTE FROM SINGAPORE BUSINESS REVIEW

Reaching the people who run Asia's businesses is harder than it used to be.

Inboxes are crowded. Attention is short. The executives you most want to reach — the founders, CFOs, and operators who actually move budgets — are the hardest to find through the usual channels. If you're building a company, a category, or a reputation, you already know this.

We've spent twenty years building the room they read. Singapore Business Review is where senior decision makers in Singapore and across Southeast Asia come for business coverage they can't get elsewhere — in print, online, and in person at the summits and roundtables we host across seven markets.

If you have something these readers should know about — a point of view worth publishing, a product worth their attention, an event worth their time — we'd like to hear what you're trying to do.