AI-powered phishing campaigns achieve a 54% click-through rate, over four times higher than traditional phishing.

45% of victims reported that phishing was the initial point of compromise in ransomware attacks

57% of organizations in the U.K. and Singapore expressed concern about social engineering tactics

57% of French organizations reported the greatest concern about AI-enabled threats, compared to an average of 45% across geographies

50% of senior decision-makers reported concern about AI-generated phishing emails, compared to 40% of junior management

Monitoring and mitigating phishing attacks consumes 9.6% of Managed Service Provider (MSP) technician time.

26% of scam victims reported phishing.

67% of people are concerned about their older loved ones falling for a suspicious email or text scam offering a sale or deal.

Nearly a third of leaders at financial services firms admit they are not fully confident employees could recognize an AI-driven phishing or social engineering threat.

33% of leaders at financial services firms say they are unprepared to recover effectively from a Phishing or smishing campaign.

52% of extortion victims agree 'I’m more likely to click a link on my phone than on my laptop'.

40% of Gen Z households reported phishing attempts.

46% of extortion targets agree 'I’m more likely to click a link on my phone than on my laptop'.

Phishing was reported by 34% of targeted consumers as a leading type of fraud experienced.

41% of schools said they have faced phishing, misinformation and other disruptive efforts.

Comcast Business blocked 497M phishing-linked C2 attempts.

20% of education institutions reported that they haven’t experienced AI-generated phishing attempts or misinformation campaigns.

36% of education institutions responded 'Not that I know of' when asked about AI-generated phishing attempts or misinformation campaigns.

Phishing and email-based attacks dropped to 46% of all incidents in 2025, down from 52.3% in 2024.

Phishing (including malspam, vishing, and malvertising) was the dominant intrusion vector, accounting for approx. 60% of cases..