What Global Surveys Say About Email Phishing: Key Statistics and Trends

The Alarming Rise in Phishing Attacks

According to the Zscaler ThreatLabz 2026 Phishing and Initial Access Report, overall phishing activity declined by approximately 20% year over year in 2025, continuing a similar decline seen in 2024. However, this does not indicate that phishing is becoming less dangerous. Attackers are increasingly shifting from high-volume campaigns toward more targeted, personalized, and AI-assisted attacks.

This shift is particularly visible in AI-generated phishing. Hoxhunt's 2026 Phishing Trends Report found that AI-generated phishing emails represented only around 4% of reported attacks in November 2025, but surged to 56% in December 2025 before settling at approximately 40% in January 2026.

These findings suggest that the phishing landscape is changing from high-volume attacks toward fewer but more convincing and sophisticated campaigns, making detection and employee awareness increasingly important.

Several factors are contributing to this evolution:

• More communication channels: Hybrid workplaces depend not only on email but also on collaboration platforms, messaging applications, and cloud services. Attackers increasingly follow employees across these channels.
• Generative AI: AI makes it easier to create convincing and personalized phishing messages at scale. Research from SlashNext reported a 4,151% increase in malicious phishing messages since the launch of ChatGPT in late 2022. This does not mean AI alone caused the increase, but it demonstrates how rapidly the phishing environment has evolved.
• More convincing impersonation: Attackers can combine publicly available information, compromised accounts, fake websites, and AI-generated content to make fraudulent requests look increasingly legitimate.

The challenge for organizations is therefore not simply to block suspicious emails. They need to understand how phishing is evolving and build layered defenses capable of addressing both technical and human risks.

Email Phishing by the Numbers

Statistics help put the scale of phishing into perspective and show where organizations should focus their security efforts.

According to the data referenced in the original research:

• Credential abuse accounts for 22% of analyzed breaches.
• Vulnerability exploitation accounts for 20%.
• Phishing accounts for 15% as an initial access vector.

These categories are closely connected. A successful phishing campaign can result in stolen credentials, which attackers can then use to gain access to email, cloud applications, or other corporate systems.

For this reason, organizations should consider phishing prevention and credential protection as complementary parts of the same security strategy.

Countries Most Targeted by Phishing

Phishing activity is global, but the distribution of attacks continues to change.

According to Zscaler ThreatLabz research, the United States remained the most targeted country despite experiencing a 31.8% decrease in phishing activity. At the same time, attackers increasingly shifted their attention toward markets such as Brazil, Hong Kong, and the Netherlands.

Countries including India, Germany, and the UK also continue to experience significant phishing activity.

The broader trend is important: attackers adapt their campaigns according to geography, digital adoption, available targets, and the effectiveness of existing security controls.

Industries Most Affected by Phishing

The industries attracting the most phishing activity continue to change as attackers focus on sectors where trusted communication, valuable credentials, and sensitive business processes create opportunities for social engineering.

Manufacturing

Manufacturing remains one of the primary industries targeted by email phishing attacks in 2026. Complex supply chains, supplier relationships, financial transactions, and access to operational systems continue to make manufacturers attractive targets.

However, the latest data also shows attackers shifting toward industries built around frequent customer and business interactions.

Services

The Services sector recorded a 65.5% year-over-year increase in phishing activity, according to the Zscaler ThreatLabz 2026 Phishing and Initial Access Report. Phishing hits increased from approximately 330.9 million to 547.7 million.

Attackers are taking advantage of everyday business processes such as billing, renewals, customer support, onboarding, and document exchange. Because these interactions naturally involve links, attachments, payments, and account information, malicious messages can be easier to disguise as legitimate business communication.

Technology

Technology companies remain valuable phishing targets because successful account compromise can provide access to cloud platforms, corporate credentials, source code, customer information, and other sensitive resources.

The latest research also shows that attackers continue to focus heavily on enterprise identities. Microsoft and Google remain among the most commonly impersonated brands in phishing attacks, reflecting the value attackers place on credentials for widely used cloud and productivity platforms.

Education

Education also remains highly exposed to phishing. Recent 2026 research shows that phishing accounted for 96% of identified cyber breaches or attacks among UK further and higher education institutions that reported an incident.

The sector presents attackers with a particularly broad attack surface: students, faculty, administrators, researchers, contractors, and external services all interact through email and cloud platforms. Constant account turnover and large user populations can make phishing attempts particularly difficult to control.

The broader trend is clear: phishing activity is increasingly concentrated around industries and workflows where attackers can exploit trusted communication, valuable identities, and routine business interactions.

Common Phishing Techniques

Phishing is no longer limited to generic emails asking recipients to reset a password. Current campaigns use several increasingly sophisticated techniques.

• Business Email Compromise (BEC): Research cited in the original article indicates that 64% of businesses reported facing BEC attacks in 2024. BEC typically involves impersonating executives, suppliers, or trusted contacts to manipulate employees into transferring money or disclosing sensitive information. The 64% figure also appears in Hoxhunt's 2025 phishing research.
• Credential phishing: Around 80% of phishing campaigns aim to steal credentials, particularly for cloud platforms such as Microsoft 365 and Google Workspace.
• HTTPS phishing: Approximately 80% of phishing websites in the referenced research used HTTPS. The important lesson is that HTTPS encrypts the connection but does not prove that a website itself is trustworthy.
• AI and deepfake impersonation: AI-generated text, voice, images, and video are giving attackers additional ways to impersonate trusted people and organizations.

These trends reinforce the need for anti-phishing defenses that evaluate more than message content alone.

Cost and Business Impact of Phishing

The financial consequences of phishing can extend far beyond the initial incident.

The original research highlights an average breach cost of USD 4.88 million, demonstrating why phishing prevention should be viewed as a business risk rather than only an IT concern.

A successful phishing attack can lead to:

• stolen credentials;
• fraudulent transactions;
• ransomware or malware infections;
• data exposure;
• regulatory penalties;
• operational downtime;
• reputational damage.

There can also be a domino effect. Stolen credentials may provide attackers with access to additional systems, allowing them to conduct more targeted attacks against executives, employees, customers, or business partners.

The faster an organization can identify and contain the initial compromise, the better its chances of limiting the overall financial and operational impact.

Employee Awareness Levels

Technology alone cannot eliminate phishing risk. Employee behavior remains an important part of the security equation.

71% of surveyed users admitted to taking risky actions, and 96% of those users knew they were taking a security risk.

The most common reasons were surprisingly practical:

• 44% said the risky action was more convenient.
• 39% wanted to save time.
• 24% were trying to meet an urgent deadline.

This demonstrates an important point: security awareness does not always translate into secure behavior.

Employees may understand the risks but still bypass security procedures when those procedures interfere with productivity or urgent business tasks.

Organizations should therefore combine awareness programs with security controls that are practical and easy to follow.

Context-Rich Awareness Training

Training should use scenarios employees are likely to encounter in their actual work.

Examples might include an unexpected invoice, an urgent password reset, a supplier requesting new payment details, or an executive asking for confidential information.

Short and relevant training can help employees recognize the psychological triggers attackers commonly exploit, including urgency, authority, fear, and curiosity.

Continuous Phishing Simulations

Regular phishing simulations can help organizations understand how employees respond to realistic attacks.

Rather than treating simulations as a simple pass-or-fail exercise, use them to identify departments, workflows, or attack techniques that require additional attention.

Running simulations periodically also allows organizations to measure whether employee behavior improves over time.

Track the Right Metrics

Useful awareness metrics include:

• phishing simulation click rate;
• phishing reporting rate;
• time to report a suspicious message;
• repeat failures.

A decreasing click rate combined with an increasing reporting rate can indicate that employees are becoming more effective at recognizing and escalating suspicious messages.

The objective should be to make employees an active layer of defense rather than simply labeling them as the organization's "weakest link."

Key Takeaways for Decision-Makers

Phishing Is Not Going Away

Phishing remains effective because it targets human behavior. Attackers exploit urgency, trust, authority, curiosity, and fear, while ready-made phishing tools make convincing campaigns easier to launch.

AI Is Raising the Stakes

Generative Artificial Intelligence (AI) makes phishing faster, more personalized, and harder to recognize. Attackers can create polished messages at scale, adapt them to specific targets, and use AI-generated voice, images, or video for impersonation.

As a result, organizations can no longer rely on obvious spelling mistakes or suspicious-looking messages as primary warning signs.

Action Plan for the C-Suite and Decision-Makers

Reducing phishing risk requires a combination of technology, employee awareness, and continuous security improvements.

Harden Email Authentication

Implement Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) to authenticate legitimate email and reduce domain spoofing.

Build Visual Trust with BIMI and VMC

Brand Indicators for Message Identification (BIMI) can display an organization's logo alongside authenticated emails in supported email clients. A Verified Mark Certificate (VMC) adds verification of the organization's identity and its right to use a qualifying trademarked logo.

BIMI and VMC complement SPF, DKIM, and DMARC rather than replace them.

Consider Common Mark Certificates

A Common Mark Certificate (CMC) provides another BIMI option for organizations whose logos may not qualify for a VMC, helping more businesses display authenticated brand logos.

Put People at the Center

Run realistic phishing simulations, track click and reporting rates, and provide continuous security training rather than relying on annual exercises.

Continuously Tune Your Defenses

Regularly review phishing incidents, employee reports, and security data to improve filtering, authentication policies, training, and incident response.

Consider Supply-Chain Risk

Extend phishing protection to third-party relationships. Suppliers, Software as a Service (SaaS) providers, contractors, and other partners with trusted access or communication channels should be included in cybersecurity risk assessments.

Conclusion

Phishing continues to evolve alongside the technologies used to prevent it. Attackers are becoming more targeted, increasingly use compromised credentials and legitimate infrastructure, and can now use AI to create convincing content at greater scale.

The statistics reinforce a clear message: phishing should be treated as an ongoing business risk rather than an occasional email-security problem.

Organizations need a layered approach that combines email authentication, anti-phishing technology, identity protection, employee awareness, continuous testing, and incident response.

Technology can stop many attacks before they reach employees, while training can help users identify what gets through. Together, these controls make it considerably harder for a single phishing message to become a serious security incident.