At CyberStreams, we help small businesses—from law firms and universities to non-profits and manufacturers—build cyber resilience through education and proactive security strategies. A recent phishing test in France has provided a surprising lesson in cyber safety that every business should take to heart.

On March 27, 2025, the French government launched a nationwide phishing simulation known as “Opération Cactus.” The test targeted 2.5 million middle and high school students across 4,700 schools. The lure? A tempting link in their digital workspaces offering cracked video games and cheats—bait tailored to the interests of young internet users.

What happened next was both surprising and insightful.

The Results: Students Show Surprising Caution

Out of 2.5 million students, only 210,000 clicked the phishing link—roughly an 8% click rate, as reported by CNIL, France’s privacy watchdog. Instead of falling victim to malware, the students were redirected to an educational video featuring an e-sports player, a police officer, and a prosecutor. Their goal? To educate students on the dangers and consequences of phishing.

While 210,000 clicks may sound alarming, this 8% failure rate is significantly lower than the 33% seen in many corporate phishing tests, according to a 2024 KnowBe4 report. These young users—often dismissed as careless due to their digital habits—actually outperformed many adults.

But the results aren’t just a pat on the back for Gen Z. The test also exposed a vulnerability: even tech-savvy youth can be tricked when the bait aligns with their interests. It’s a reminder that awareness—not just access to technology—is what truly drives cyber resilience.

What This Means for Your Business

So, what can small businesses learn from this? A lot. The standout performance of French students suggests that early education in cybersecurity works—and that ongoing training could help adults improve too.

At CyberStreams, we see firsthand how regular awareness training empowers employees to recognize and report threats. And with phishing attacks up 150% since 2019 (APWG, 2022) and 66% of ransomware attacks beginning with phishing emails (Hiscox, 2022), proactive education isn’t optional—it’s essential.

Three Takeaways and Next Steps

1. Train Early and Often
   Start phishing awareness training today. CyberStreams offers engaging, bite-sized modules that keep your team informed and alert.

2. Simulate Real Attacks
   Test your staff’s readiness with custom phishing simulations. We’ll create realistic scenarios tailored to your industry and risk profile.

3. Reward Vigilance
   Encourage employees to report suspicious emails. CyberStreams can help you build a culture where cybersecurity awareness is recognized and rewarded.

Conclusion: Learn from the Kids, Protect Your Business

“Opération Cactus” proves that awareness makes a difference—even among digital natives. The surprising success of France’s students should be a wake-up call for organizations everywhere: if kids can beat the phish, your team can too—with the right training.

Don’t wait for an incident to expose your vulnerabilities.

Partner with CyberStreams to strengthen your human firewall and make cyber threats one less thing to worry about.