With over 3.4 billion phishing emails clogging inboxes every single day, a startling 74% of cybersecurity breaches rely on a simple, unsettling truth: the most effective vulnerability isn't in our software, but in ourselves.
Key Takeaways
- 74% of cybersecurity breaches involve the human element including social engineering
- Phishing accounts for 36% of all data breaches
- 82% of breaches involved a human element in 2022
- Phishing emails evade filters 1 in 10 times
- Vishing (voice phishing) used in 20% of attacks
- Smishing (SMS phishing) attacks up 328% in 2022
- Average BEC scam costs $4.91 million to detect
- Phishing causes $4.91 billion annual losses
- Global cost of cybercrime $8 trillion, 50% social eng related
- 75% of executives targeted more likely to suffer breach
- Millennials 36% more likely to fall for phishing
- Finance sector 24% of phishing targets
- 87% of users fail to recognize phishing
- Security awareness training reduces clicks by 40%
- MFA blocks 99.9% account compromise
Social engineering attacks are alarmingly common because humans are the weakest security link.
Common Types
1Phishing emails evade filters 1 in 10 times
Verified2Vishing (voice phishing) used in 20% of attacks
Verified3Smishing (SMS phishing) attacks up 328% in 2022
Verified4Spear-phishing comprises 65% of targeted attacks
Directional5Business Email Compromise (BEC) is 90% social engineering
Single source6Pretexting used in 15% of successful breaches
Verified7Baiting attacks involve USB drops in 12% cases
Verified8Quishing (QR code phishing) rose 51% in 2023
Verified9Tailgating/physical access in 5% of social engineering
Directional10Whaling targets executives in 8% of phishing
Single source11Email phishing is 94% of social engineering vectors
Verified12BEC scams average $120,000 loss per incident
Verified13Vishing success rate 7% higher than email phishing
Verified14Smishing open rates 20% vs 3% email
Directional1551% of phishing uses malicious attachments
Single source1649% use malicious links in phishing
Verified17Tech support scams (vishing) in 25% of calls
Verified18Dumpster diving in 3% physical social engineering
Verified19Watering hole attacks combined with social eng 10%
Directional2070% of ransomware starts with phishing
Single source21Fake websites in 80% of phishing campaigns
Verified22Multi-channel attacks (email+SMS) 15%
Verified23Impersonation of brands in 92% phishing
Verified24CEO fraud (whaling) 14% of BEC
Directional25Shoulder surfing in 4% incidents
Single source2640% phishing exploits current events
VerifiedCommon Types Interpretation
The grim truth is that while email remains the con artist’s favorite workbench, this buffet of threats—from vishing’s persuasive calls to smishing’s explosive growth and quishing’s quiet rise—proves our collective human curiosity is now the most exploited vulnerability in the world.
Financial and Economic Impact
1Average BEC scam costs $4.91 million to detect
Verified2Phishing causes $4.91 billion annual losses
Verified3Global cost of cybercrime $8 trillion, 50% social eng related
Verified4Average data breach cost $4.45 million, social eng primary
Directional5BEC losses $2.7 billion in 2022
Single source6Phishing costs SMEs $25,000 per incident
Verified7Ransomware via phishing averages $1.85 million
Verified860% of breaches cost over $1 million, human error
Verified9Tech support scams $575 million losses 2022
Directional10Average phishing training ROI 14x, implying high costs
Single source11Social engineering breach downtime 23 days average
Verified12$9.44 million average megabreach cost
Verified13Phishing responsible for 90% of breaches costing $3.9M
Verified14BEC median loss $50,000 per victim
Directional15Cybercrime losses $10.3 billion reported to FBI 2022
Single source16Email fraud losses $12.5 billion globally 2022
Verified17SME breach cost $3.31 million average
Verified18Notification costs $0.28 per record post-breach
Verified19Lost business post-social eng breach 31%
Directional20Incident response costs $1.94 million average
Single source21Exfiltration costs $5.09 million
Verified22Personal data theft via phishing $42 per record
Verified2350% of orgs paid ransom after phishing ransomware
Verified24Average ransom $1.54 million
Directional25Downtime costs $1.85 million for ransomware
Single sourceFinancial and Economic Impact Interpretation
If the multi-trillion-dollar tax of global cybercrime has taught us anything, it’s that the most expensive line item on any budget is the assumption that your employees wouldn't click on a really convincing email about an overdue invoice.
Mitigation and Awareness
187% of users fail to recognize phishing
Verified2Security awareness training reduces clicks by 40%
Verified3MFA blocks 99.9% account compromise
Verified4Simulated phishing training cuts risks 90%
Directional569% fewer incidents post-training
Single source6Email filters catch 97% of phishing
Verified7Awareness programs reduce human error 70%
Verified892% phish-prone users after training drop to 5%
Verified9Reporting suspicious emails rises 50% with training
Directional10Zero-trust reduces social eng impact 80%
Single source11AI detection improves phishing catch by 30%
Verified12Regular simulations needed, 50% forget without
Verified1382% support mandatory training
Verified14Password managers prevent 81% credential theft
Directional15DMARC adoption cuts spoofing 96%
Single source1640% risk reduction with ongoing training
Verified1775% of orgs lack phishing simulations
Verified18Training ROI $11 per $1 spent
Verified1965% less BEC with verification policies
Directional20Awareness cuts vishing success 60%
Single source2190% reduction in clicks after 90 days training
Verified22Least privilege access blocks 55% escalation
Verified23Employee reporting stops 19% attacks early
Verified2452% orgs improved post-training metrics
DirectionalMitigation and Awareness Interpretation
The data reveals that while humans are predictably the weakest link, with 87% initially falling for phishing, we are also the strongest defense when properly equipped, as comprehensive training and layered security measures can collectively reduce the human risk factor by over 90% and turn employees into a formidable early-warning system.
Prevalence and Frequency
174% of cybersecurity breaches involve the human element including social engineering
Verified2Phishing accounts for 36% of all data breaches
Verified382% of breaches involved a human element in 2022
Verified4Social engineering was used in 19% of breaches last year
Directional5300,000 phishing sites are created daily
Single source61 in 10 users receive phishing emails daily
Verified790% of organizations experienced at least one successful phishing attack in 2022
Verified8Social engineering incidents rose 11% year-over-year
Verified916,000 phishing attacks reported weekly
Directional1085% of data breaches are caused by phishing
Single source11Over 3.4 billion phishing emails sent daily
Verified1222 billion spam emails sent per day with phishing
Verified1396% of social engineering attacks via email
Verified14Phishing attacks increased by 65% in 2022
Directional151.2 million phishing complaints to FTC in 2022
Single source1683% of UK businesses hit by phishing
Verified17Social engineering in 98% of attacks on businesses
Verified184.71 billion email accounts targeted by phishing annually
Verified191 in 99 emails is phishing
Directional20Phishing volume up 47% in Q1 2023
Single source2168% of businesses faced social engineering in 2023
Verified22Over 800,000 phishing sites active monthly
Verified23Social engineering attacks doubled since 2020
Verified2491% of cyberattacks start with phishing email
Directional255 billion phishing emails per day globally
Single source2676% of organizations tested had phish-prone users
Verified27Phishing reports up 1500% since COVID
Verified2832% increase in BEC scams
Verified29241,000 unique phishing reports in 2022
Directional3060% of companies experienced phishing in past year
Single sourcePrevalence and Frequency Interpretation
Despite our relentless pursuit of digital fortresses, the most exploited vulnerability remains, ironically, the same one that mastered the opposable thumb: the human brain, now besieged by a relentless daily flood of deceptively personal messages.
Victim Characteristics
175% of executives targeted more likely to suffer breach
Verified2Millennials 36% more likely to fall for phishing
Verified3Finance sector 24% of phishing targets
Verified4Healthcare 18% of breaches via social eng
Directional5SMEs 43% more vulnerable to phishing
Single source695% of breaches target employees
Verified7Women 12% less likely to click phishing links
Verified8C-suite 4x more targeted by whaling
Verified9Remote workers 3x more susceptible
Directional1022-25 age group highest click rate 12.3%
Single source11Government sector 16% phishing victims
Verified12Retail 22% hit by social engineering
Verified13IT staff fall for phishing 40% rate
Verified14Non-tech employees 2.5x more likely victims
Directional1560% of executives bypass security training
Single source16US victims 70% of global phishing reports
Verified17Healthcare workers 25% phish-prone
Verified18Finance employees 15% higher click rate
Verified19Contractors 30% more vulnerable
Directional2046-55 age group 9.5% click rate
Single source21Education sector 28% breach rate social eng
Verified22Females report 20% more phishing incidents
Verified23New hires 50% more susceptible first month
Verified24Manufacturing 14% social eng targets
Directional25Overconfident users click 3x more
Single sourceVictim Characteristics Interpretation
Executives can’t skip security training because the best way to a company’s secrets is still through a human, whether it’s a phish-prone new hire, an overconfident millennial, a targeted C-suite whale, or the IT guy who really should know better.
Sources & References
- Reference 1VERIZONverizon.comVisit source
- Reference 2APWGapwg.orgVisit source
- Reference 3PROOFPOINTproofpoint.comVisit source
- Reference 4IBMibm.comVisit source
- Reference 5KEEPERSECURITYkeepersecurity.comVisit source
- Reference 6STATIONXstationx.netVisit source
- Reference 7ZDNETzdnet.comVisit source
- Reference 8TALOSTYSTEMStalostystems.comVisit source
- Reference 9KNOWBE4knowbe4.comVisit source
- Reference 10CISCOcisco.comVisit source
- Reference 11FTCftc.govVisit source
- Reference 12GOVgov.ukVisit source
- Reference 13HBRhbr.orgVisit source
- Reference 14EMAILSECURITYCHECKERemailsecuritychecker.comVisit source
- Reference 15BARRACUDAbarracuda.comVisit source
- Reference 16SOPHOSsophos.comVisit source
- Reference 17ZSCALERzscaler.comVisit source
- Reference 18CROWDSTRIKEcrowdstrike.comVisit source
- Reference 19PHISHMEphishme.comVisit source
- Reference 20SECURITYsecurity.orgVisit source
- Reference 21IC3ic3.govVisit source
- Reference 22FBIfbi.govVisit source
- Reference 23PONEMONponemon.orgVisit source
- Reference 24MIMECASTmimecast.comVisit source
- Reference 25LOOKOUTlookout.comVisit source
- Reference 26CHECKPOINTcheckpoint.comVisit source
- Reference 27SANSsans.orgVisit source
- Reference 28CORESECURITYcoresecurity.comVisit source
- Reference 29ZIMPERIUMzimperium.comVisit source
- Reference 30IMPERVAimperva.comVisit source
- Reference 31BRANDSHIELDbrandshield.comVisit source
- Reference 32CYBERSECURITYVENTUREScybersecurityventures.comVisit source
- Reference 33HIMSShimss.orgVisit source
- Reference 34PHISHINGphishing.orgVisit source
- Reference 35MICROSOFTmicrosoft.comVisit source
- Reference 36NISTnist.govVisit source
- Reference 37VALIMAILvalimail.comVisit source