Seems pretty typical for results of phishing campaigns - although they targeted 50 people, which is not very representative to get overall numbers and stats on

Seems pretty typical for results of phishing campaigns - although they targeted 50 people, which is not very representative to get overall numbers and stats on different disciplines in a larger organization. Results are largely driven by the kind of phish that is sent and if its click-worthy. Some companies do these exercises every month.