Each missed phishing email costs an average of $36.29 to investigate and remediate.

SEG miss rates range from 38.4 to 101 phishing emails per 100 mailboxes monthly.

49% of SMBs believe AI will be most useful in flagging phishing emails and texts.

Phishing texts and emails (48%) were a common cyber disruption faced by SMBs in the past 12 months.

Most polymorphic phishing emails are sent from compromised accounts (52%), followed by phishing domains (25%), and webmail (20%).

The most common third-party platforms used for phishing were: • sendgrid.com • salesforce.com • amazonaws.com • sendlayer.com • mailgun.com • marketo.com.

The top three words used in phishing emails: Urgent, Review, Sign.

There has been a 57.9% increase in phishing attacks being sent from compromised accounts getting through traditional detection.

Job application-related phishing attacks are not only sent to individual accounts (24%) but also shared mailboxes (52%) and individual inboxes with activated delegate functions (21%) (e.g. a personal assistant has access to an executive’s inbox).

Between September 15, 2024 and February 14, 2025, there was a 11.1% incease in phishing emails sent from compromised email addresses within the supply chain.

Between September 15, 2024 and February 14, 2025, there was a 67.4% incease in the use of third-party platforms for phishing emails.

There was a 17.3% increase in phishing emails between September 15, 2024 and February 14, 2025 compared to the previous six months.

Ransomware payloads in phishing attacks have risen by 22.6% over six months, with a sharp 57.5% increase in just three months.

64% of phishing attacks are focused on engineering roles.

On average, phishing emails contained 1058 characters (~188 words)

Between September 15, 2024 and February 14, 2025, there was a 49.9% increase in phishing emails sent from compromised accounts.

New starters typically received a phishing email after 3 weeks.

3,829 days - average domain age for phishing attacks getting through.

The phishing hyperlink, malware, and social engineering payloads getting through traditional detection have surged, with phishing hyperlinks increasing by 36.8%, malware by 20%, and social engineering tactics by 14.2% compared to the previous six months.

81.9% of phishing victims had their emails leaked in previous breaches.