GITNUXREPORT 2025

Social Engineering Statistics

Social engineering causes most breaches, highlighting urgent need for employee security training.

Jannik Linder

Co-Founder of Gitnux, specialized in content and tech since 2016.

First published: April 29, 2025

Our Commitment to Accuracy

Rigorous fact-checking • Reputable sources • Regular updatesLearn more

Statistic 1

98% of cybersecurity breaches involve social engineering

Statistic 2

91% of cyberattacks start with a phishing email

Statistic 3

60% of organizations reported at least one successful social engineering attack in a year

Statistic 4

75% of security professionals believe that employees are the weakest link in cybersecurity

Statistic 5

45% of data breaches are caused by social engineering tactics

Statistic 6

88% of organizations experienced at least one social engineering attack in 2023

Statistic 7

Over 80% of data breaches involve some form of social engineering

Statistic 8

35% of social engineering attacks involve pretexting

Statistic 9

55% of employees admit they would respond to a phishing email, risking security

Statistic 10

74% of organizations do not test their employees regularly for social engineering susceptibility

Statistic 11

85% of breaches involve a human element, primarily social engineering

Statistic 12

41% of social engineering attacks target employees via email

Statistic 13

95% of cybersecurity breaches are due to human error, often facilitated by social engineering

Statistic 14

78% of organizations have experienced at least one security breach caused by social engineering in the past year

Statistic 15

The success rate of phishing attacks can be as high as 30%

Statistic 16

Approximately 4.8 billion people worldwide are targets of social engineering scams

Statistic 17

87% of security leaders say social engineering is their biggest security concern

Statistic 18

68% of phishing emails are opened based on the perceived legitimacy of the sender

Statistic 19

82% of employees admit they do not recognize social engineering tactics

Statistic 20

71% of organizations did not have an effective security awareness program in 2022

Statistic 21

90% of cybercriminals use social engineering as part of their attack chain

Statistic 22

48% of organizations experienced identity theft linked to social engineering

Statistic 23

72% of organizations have experienced some form of social engineering attack in the past year

Statistic 24

65% of employees have shared confidential information under social engineering pressure

Statistic 25

83% of security breaches involving social engineering could have been prevented with better training

Statistic 26

57% of companies have no formalized process to detect social engineering attacks

Statistic 27

56% of social engineering emails contain malicious attachments or links

Statistic 28

54% of phishing emails are identified by users as spam, but many still click links or open attachments

Statistic 29

The most common social engineering tactic is impersonation, used in 71% of attacks

Statistic 30

89% of all data breaches are attributed to social engineering and human error

Statistic 31

93% of employees do not receive regular security awareness training, increasing vulnerability to social engineering

Statistic 32

54% of businesses do not have a formal incident response plan to social engineering attacks

Statistic 33

84% of social engineering attacks begin with an email

Statistic 34

77% of social engineering attacks involve some form of pretexting

Statistic 35

92% of organizations believe that social engineering will be a primary attack vector in the next five years

Statistic 36

86% of cybersecurity professionals consider social engineering the most significant threat to organizations

Statistic 37

The average cost of a successful social engineering attack for an enterprise is $1.6 million

Statistic 38

67% of phishing campaigns are tailored to target specific organizations or individuals

Statistic 39

80% of cybersecurity attacks involve some form of social engineering

Statistic 40

69% of attacks in the healthcare sector are caused by phishing and social engineering

Statistic 41

66% of phishing attacks now leverage mobile devices

Statistic 42

42% of social engineering attacks utilize fake websites to lure victims

Statistic 43

50% of targeted phishing attacks use urgency and fear tactics to manipulate victims

Statistic 44

The average lifespan of a phishing site before being taken down is less than 48 hours

Slide 1 of 44

Sources

Our Reports have been cited by:

Trust Badges - Publications that have cited our reports

Key Highlights

98% of cybersecurity breaches involve social engineering
91% of cyberattacks start with a phishing email
60% of organizations reported at least one successful social engineering attack in a year
75% of security professionals believe that employees are the weakest link in cybersecurity
45% of data breaches are caused by social engineering tactics
67% of phishing campaigns are tailored to target specific organizations or individuals
The average cost of a successful social engineering attack for an enterprise is $1.6 million
88% of organizations experienced at least one social engineering attack in 2023
Over 80% of data breaches involve some form of social engineering
35% of social engineering attacks involve pretexting
55% of employees admit they would respond to a phishing email, risking security
74% of organizations do not test their employees regularly for social engineering susceptibility
85% of breaches involve a human element, primarily social engineering

Did you know that a staggering 98% of cybersecurity breaches involve social engineering, making it the most insidious threat targeting organizations worldwide?

Human Element and Employee Awareness

98% of cybersecurity breaches involve social engineering
91% of cyberattacks start with a phishing email
60% of organizations reported at least one successful social engineering attack in a year
75% of security professionals believe that employees are the weakest link in cybersecurity
45% of data breaches are caused by social engineering tactics
88% of organizations experienced at least one social engineering attack in 2023
Over 80% of data breaches involve some form of social engineering
35% of social engineering attacks involve pretexting
55% of employees admit they would respond to a phishing email, risking security
74% of organizations do not test their employees regularly for social engineering susceptibility
85% of breaches involve a human element, primarily social engineering
41% of social engineering attacks target employees via email
95% of cybersecurity breaches are due to human error, often facilitated by social engineering
78% of organizations have experienced at least one security breach caused by social engineering in the past year
The success rate of phishing attacks can be as high as 30%
Approximately 4.8 billion people worldwide are targets of social engineering scams
87% of security leaders say social engineering is their biggest security concern
68% of phishing emails are opened based on the perceived legitimacy of the sender
82% of employees admit they do not recognize social engineering tactics
71% of organizations did not have an effective security awareness program in 2022
90% of cybercriminals use social engineering as part of their attack chain
48% of organizations experienced identity theft linked to social engineering
72% of organizations have experienced some form of social engineering attack in the past year
65% of employees have shared confidential information under social engineering pressure
83% of security breaches involving social engineering could have been prevented with better training
57% of companies have no formalized process to detect social engineering attacks
56% of social engineering emails contain malicious attachments or links
54% of phishing emails are identified by users as spam, but many still click links or open attachments
The most common social engineering tactic is impersonation, used in 71% of attacks
89% of all data breaches are attributed to social engineering and human error
93% of employees do not receive regular security awareness training, increasing vulnerability to social engineering
54% of businesses do not have a formal incident response plan to social engineering attacks
84% of social engineering attacks begin with an email
77% of social engineering attacks involve some form of pretexting
92% of organizations believe that social engineering will be a primary attack vector in the next five years
86% of cybersecurity professionals consider social engineering the most significant threat to organizations

Human Element and Employee Awareness Interpretation

With over 98% of breaches involving social engineering, it's clear that in the cybersecurity race, human gullibility remains the industry's biggest obstacle—making the human firewall the most critical, yet often overlooked, line of defense.

Impact and Costs of Cybersecurity Breaches

The average cost of a successful social engineering attack for an enterprise is $1.6 million

Impact and Costs of Cybersecurity Breaches Interpretation

With the average price tag of $1.6 million per successful social engineering attack, it's clear that even in the digital age, a well-placed human 'hole' can cost organizations more than many tech upgrades—reminding us that cybersecurity isn't just a tech issue, but a human one.

Phishing and Social Engineering Attacks

67% of phishing campaigns are tailored to target specific organizations or individuals
80% of cybersecurity attacks involve some form of social engineering
69% of attacks in the healthcare sector are caused by phishing and social engineering
66% of phishing attacks now leverage mobile devices
42% of social engineering attacks utilize fake websites to lure victims

Phishing and Social Engineering Attacks Interpretation

These stark statistics reveal that social engineering—particularly through targeted phishing on mobile devices and fake websites—has become the insidious backbone of nearly overwhelming cyber threats, demanding organizations elevate their human firewall alongside technological defenses.

Tactics and Trends in Cyber Threats

50% of targeted phishing attacks use urgency and fear tactics to manipulate victims
The average lifespan of a phishing site before being taken down is less than 48 hours

Tactics and Trends in Cyber Threats Interpretation

With half of targeted phishing attacks relying on urgency and fear to deceive and phishing sites vanishing in less than two days, cybersecurity experts must prioritize rapid detection and user awareness to stay ahead of these fleeting traps.