35 percent of employees admit to clicking phishing links. Organizations report credential theft from these attacks in 27 percent of cases. Resulting delays push average breach identification to 204 days.
Key Takeaways
- 27% of organizations reported that phishing emails resulted in credential theft leading to account compromise in 2023, according to the 2024 Verizon DBIR (credential compromise patterns).
- 35% of employees admitted they have clicked on a phishing link, according to Tessian’s employee behavior survey summarized in its State of Email Security reporting.
- The FBI IC3 received 35,000+ reports of BEC in 2023, reflecting the scale of impersonation phishing-driven fraud.
- 99% of spear-phishing emails were delivered using compromised or spoofed domains in one industry analysis of email authentication failures included in Cisco Talos reporting for business email compromise patterns.
- 6.4% of all reported URLs were phishing URLs in Google’s transparency reporting for Safe Browsing (phishing and social engineering categories).
- The average time to identify a breach was 204 days in 2023, increasing exposure after phishing-enabled compromises as summarized in IBM’s breach cost research.
- 58% of organizations said phishing scams caused credential theft or account compromise, according to SlashNext’s or similar vendor survey included in 2023/phishing protection reporting.
- 73% of enterprises had a modern phishing prevention platform (anti-phishing + security awareness), per a 2024 Gartner-informed vendor survey summarized in industry reporting.
- NIST SP 800-63B defines phishing resistance as an MFA property that prevents the use of credentials to authenticate after interception, per the standard’s authentication requirements.
- 2.8% of all incoming mail in a sample was phishing-related in a Microsoft Security Intelligence report, based on measured email threat classifications.
- Google’s Safe Browsing data shows phishing protection prevented users from accessing millions of phishing pages by redirecting or warning users (counted in transparency reporting).
- URL-based phishing detection accuracy exceeded 99% in a peer-reviewed evaluation of state-of-the-art phishing URL classification approaches (F1-score reported in the study).
- 76% of organizations reported using some form of email security technology, including anti-phishing, in a 2024 survey on email threat prevention.
- 44% of organizations experienced credential compromise incidents attributed to phishing in 2023, according to CrowdStrike’s 2024 global threat report’s initial access breakdown.
- Phishers used dynamic look-alike domains in 29% of phishing campaigns observed in 2023, according to an APWG domain/brand tactics analysis.
Phishing remains a major threat, with many employees clicking and attackers driving credential theft and costly breaches.
Related reading
01 · Category
User Impact2 stats
01
27% of organizations reported that phishing emails resulted in credential theft leading to account compromise in 2023, according to the 2024 Verizon DBIR (credential compromise patterns).
02
35% of employees admitted they have clicked on a phishing link, according to Tessian’s employee behavior survey summarized in its State of Email Security reporting.
Interpretation
User Impact Interpretation
For the user impact category, phishing is directly harming people as 27% of organizations reported credential theft that led to account compromise in 2023 and 35% of employees admitted clicking a phishing link.
02 · Category
Spearphishing3 stats
01
The FBI IC3 received 35,000+ reports of BEC in 2023, reflecting the scale of impersonation phishing-driven fraud.
02
99% of spear-phishing emails were delivered using compromised or spoofed domains in one industry analysis of email authentication failures included in Cisco Talos reporting for business email compromise patterns.
03
6.4% of all reported URLs were phishing URLs in Google’s transparency reporting for Safe Browsing (phishing and social engineering categories).
Interpretation
Spearphishing Interpretation
For spearphishing, the threat is driven by high-volume impersonation and credential-stealing tactics, with the FBI receiving 35,000+ BEC reports in 2023, 99% of spear-phishing emails tied to compromised or spoofed domains, and Google reporting that 6.4% of all reported URLs are phishing links.
03 · Category
Financial Impact2 stats
01
The average time to identify a breach was 204 days in 2023, increasing exposure after phishing-enabled compromises as summarized in IBM’s breach cost research.
02
58% of organizations said phishing scams caused credential theft or account compromise, according to SlashNext’s or similar vendor survey included in 2023/phishing protection reporting.
Interpretation
Financial Impact Interpretation
For the financial impact of phishing, it is taking an average of 204 days in 2023 to identify a breach while 58% of organizations report phishing scams lead to credential theft or account compromise, meaning delayed detection is amplifying direct monetary risk.
04 · Category
Defense And Controls2 stats
01
73% of enterprises had a modern phishing prevention platform (anti-phishing + security awareness), per a 2024 Gartner-informed vendor survey summarized in industry reporting.
02
NIST SP 800-63B defines phishing resistance as an MFA property that prevents the use of credentials to authenticate after interception, per the standard’s authentication requirements.
Interpretation
Defense And Controls Interpretation
In the Defense And Controls category, 73% of enterprises already use modern phishing prevention platforms that combine anti phishing with security awareness, and this aligns with the NIST view that phishing resistance is achieved through MFA properties that block credential use after interception.
05 · Category
Detection Performance6 stats
01
2.8% of all incoming mail in a sample was phishing-related in a Microsoft Security Intelligence report, based on measured email threat classifications.
02
Google’s Safe Browsing data shows phishing protection prevented users from accessing millions of phishing pages by redirecting or warning users (counted in transparency reporting).
03
URL-based phishing detection accuracy exceeded 99% in a peer-reviewed evaluation of state-of-the-art phishing URL classification approaches (F1-score reported in the study).
04
A systematic review reported that machine-learning classifiers achieved phishing webpage detection rates typically above 90% in cross-validation settings across multiple studies.
05
A 2021 IEEE study evaluating phishing email detection using NLP reported an F1-score of 0.92 for its best-performing model on an email dataset.
06
Phishing email detection via transformer-based models achieved 0.95 precision in a 2022 peer-reviewed evaluation on labeled phishing email corpora.
Interpretation
Detection Performance Interpretation
For the Detection Performance category, the reported results trend strongly toward very high effectiveness, with phishing URL classification accuracy above 99% and NLP or transformer-based phishing email detection reaching around 0.92 to 0.95 F1 or precision, far exceeding what would be expected from low-signal heuristics.
More related reading
06 · Category
User Adoption1 stats
01
76% of organizations reported using some form of email security technology, including anti-phishing, in a 2024 survey on email threat prevention.
Interpretation
User Adoption Interpretation
From the 2024 survey, 76% of organizations report using email security technology like anti phishing, showing strong user adoption of defenses at scale within the User Adoption category.
07 · Category
Industry Trends3 stats
01
44% of organizations experienced credential compromise incidents attributed to phishing in 2023, according to CrowdStrike’s 2024 global threat report’s initial access breakdown.
02
Phishers used dynamic look-alike domains in 29% of phishing campaigns observed in 2023, according to an APWG domain/brand tactics analysis.
03
In 2023, the APWG reported that 1 in 3 organizations targeted with phishing experienced credential-harvesting attempts in those campaigns, per APWG’s observed campaign taxonomy.
Interpretation
Industry Trends Interpretation
In the industry trends for phishing, the data shows phishing-driven credential compromise is widespread with 44% of organizations affected in 2023, while 29% of campaigns used dynamic look-alike domains and 1 in 3 targeted organizations faced credential-harvesting attempts.
08 · Category
Cost Analysis1 stats
01
Organizations that take more than 200 days to identify and contain breaches reported significantly higher breach costs in 2023, consistent with the Ponemon/IBM breach cost benchmark for phishing-enabled compromises.
Interpretation
Cost Analysis Interpretation
For cost analysis, the data shows that organizations taking more than 200 days to identify and contain phishing breaches in 2023 reported significantly higher breach costs, underscoring how prolonged response times can sharply inflate financial impact.
09 · Category
Performance Metrics5 stats
01
In a 2022 peer-reviewed evaluation, transformer-based phishing detection achieved 95% precision on labeled phishing email corpora, as reported in the study’s experimental results.
02
A 2021 peer-reviewed NLP phishing study reported an F1-score of 0.92 for its best model on an email dataset, reflecting strong recall/precision tradeoffs.
03
A 2020 cross-study systematic review found that phishing webpage classifiers often reported detection performance above 90% across datasets, as summarized in the review.
04
In a 2023 study of user behavior, 40% of participants reported falling for a phishing message when it included urgency cues, demonstrating the strength of social-engineering content.
05
A 2022 randomized controlled trial found that tailored security training reduced phishing click rates by 40% compared with generic training, indicating measurable mitigation.
Interpretation
Performance Metrics Interpretation
Across the performance metrics reported in these studies, phishing detection and countermeasures look strongest when models or training incorporate effective signals, with reported detection metrics frequently above 90% and tailored security training cutting phishing click rates by 40% compared with generic approaches.
report visual · Key figures
Phishing Impact vs. Prevention (Key Stats)
Click rates and credential compromise are common, while adoption of phishing prevention technology varies.
35%
35% of employees admitted they have clicked on a phishing link, according to Tessian’s employee behavior survey summariz
44%
44% of organizations experienced credential compromise incidents attributed to phishing in 2023, according to CrowdStrik
73%
73% of enterprises had a modern phishing prevention platform (anti-phishing + security awareness), per a 2024 Gartner-in
76%
76% of organizations reported using some form of email security technology, including anti-phishing, in a 2024 survey on
27%
27% of organizations reported that phishing emails resulted in credential theft leading to account compromise in 2023, a
source-verifiedtessian.com · crowdstrike.com · checkpoint.com · riskbasedsecurity.com · verizon.com2024
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Thomas Lindqvist. (2026, February 13). Phishing Email Statistics. Gitnux. https://gitnux.org/phishing-email-statistics
MLA
Thomas Lindqvist. "Phishing Email Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/phishing-email-statistics.
Chicago
Thomas Lindqvist. 2026. "Phishing Email Statistics." Gitnux. https://gitnux.org/phishing-email-statistics.
Sources & references
25 datasets cited across this report · attribution is report-level
+6 additional datasets cited (not shown individually)