Three in four (75%) of users have encountered social engineering attempts like phishing and impersonation scams.

54% of enterprises said phishing-related data breaches was one of the most common ways to lose data.

Only 53% of healthcare organizations run phishing simulations.

83% of respondents cited attacks on local or cloud storage as a top risk, ranking second only to phishing.

84% of respondents cited phishing as a top risk.

Nearly half (46%) of organizations experienced an uptick in targeted phishing attacks.

92% of the world's top email domains are reported to remain unprotected against phishing and spoofing.

Only 7.7% of the world’s top 1.8 million email domains are fully protected against phishing and spoofing by having implemented the most stringent DMARC policy, 'p=reject'1.

Reports of phishing scams rose by a staggering 466% compared to the previous quarter.

Reports of phishing scams rose by a staggering 466% compared to the previous quarter.

Phishing now makes up nearly 32% of all scam submissions to the Norton Genie scam detector platform.

Security awareness training reduced phishing susceptibility from approximately 33.1% to just 4.1% after one year in state, local, tribal, and territorial (SLTT) governments.

Security awareness training reduced phishing susceptibility from approximately 33.1% to just 4.1% after one year in state, local, tribal, and territorial (SLTT) governments.

Phishing has risen to second place of most popular attack types.

Cofense Phishing Defense Center (PDC) tracked one malicious email every 42 seconds in 2024. Many of these were part of polymorphic phishing attacks.

Cofense Phishing Defense Center (PDC) tracked one malicious email every 42 seconds in 2024. Many of these were part of polymorphic phishing attacks.

Globally, the top three most at-risk industries with the highest baseline PPP were Healthcare & Pharmaceuticals (41.9%), Insurance (39.2%), and Retail & Wholesale (36.5%).

After implementing phishing training, the global PPP fell by 40% in just three months.

The global average baseline PPP before training was 33.1%. This means approximately one-third of employees interact with phishing simulations before undergoing best-practice security awareness training.

After 12 months of security training, the global Phish-prone™ Percentage (PPP) dropped to 4.1%.