Spam filters classify more than 90 percent of all processed email as unsolicited before it reaches inboxes. Phishing and spam still drive the majority of credential theft attempts. Recent surveys show that 58 percent of IT security professionals encountered ransomware delivered through email channels in the past year.
Key Takeaways
- A 2020 study in the ACM SIGCOMM/Internet measurement community found that a large fraction of global unsolicited email uses spoofed sending identities (Spoofing prevalence measured across collected traces).
- Spam is the primary vector for credential theft in many phishing campaigns; a 2021 PhishLabs study reported that phishing and spam drove the majority of reported theft attempts (measured in their dataset).
- In 2023, ESET telemetry showed that a high share of detected malicious emails used social engineering rather than attachment-based malware (ESET threat report).
- In 2022, Google’s transparency report showed that its spam filters accounted for 90%+ of processed emails being auto-classified as spam before reaching inboxes for most users (classified share).
- In 2024, Cloudmark (Proofpoint) reported that its anti-spam systems reduced spam reaching inboxes by 99% in customer environments (vendor claim with percentage).
- In 2024, Ponemon/IBM reported that the average time to contain a breach was 72 days (IBM Cost of a Data Breach 2024).
- As of 2024, the DMARC adoption rate was 33% of all domains publishing DMARC (DMARC adoption metrics).
- In 2022, the IC3/FBI reported 64,342 phishing incidents resulting in $52.0 million in losses (FBI Internet Crime Report).
- In 2024, IC3 reported that 28,000+ non-business email compromises (N(B)EC) were reported with losses included in the BEC category totals (IC3 2023 report breakdown).
- Spam-related fraud losses reached $1.2 billion globally in 2023 as reported by the cybersecurity insurance market analysis (industry publication).
- In 2024, Gartner forecasted worldwide end-user spending on security and risk management technologies to reach $188.3 billion (Gartner).
- The global email security market was valued at $5.2 billion in 2023 and is projected to reach $13.8 billion by 2030 (MarketsandMarkets).
- The global anti-spam software market is expected to grow from $1.2 billion in 2022 to $2.9 billion by 2027 (MarketsandMarkets).
- 1 in 5 adults (20%) reported experiencing at least one phishing attempt in the past 12 months in 2023 (survey statistic reported by U.S. government).
- In 2024, 58% of surveyed IT security professionals said they had experienced ransomware delivered via email within the last 12 months (survey-based finding in an industry report).
Spam and phishing remain overwhelmingly dominant, exploiting spoofed identities and social engineering to drive major losses.
Related reading
01 · Category
Market Size7 stats
01
In 2024, Gartner forecasted worldwide end-user spending on security and risk management technologies to reach $188.3 billion (Gartner).
02
The global email security market was valued at $5.2 billion in 2023 and is projected to reach $13.8 billion by 2030 (MarketsandMarkets).
03
The global anti-spam software market is expected to grow from $1.2 billion in 2022 to $2.9 billion by 2027 (MarketsandMarkets).
04
The global cloud email security market is projected to grow at a CAGR of 14.6% from 2023 to 2028 (Fortune Business Insights).
05
The global email security services market size is projected to reach $6.7 billion by 2030 (Research and Markets).
06
The anti-phishing software market was valued at $1.1 billion in 2022 and projected to reach $3.3 billion by 2030 (Fortune Business Insights).
07
The global email encryption market is projected to grow from $2.0 billion in 2023 to $6.0 billion by 2030 (MarketsandMarkets).
Interpretation
Market Size Interpretation
From a market size perspective, the spam email and related security segment is expanding rapidly, with the global email security market projected to rise from $5.2 billion in 2023 to $13.8 billion by 2030 alongside fast growth in anti-spam software from $1.2 billion in 2022 to $2.9 billion by 2027.
02 · Category
Threat Landscape6 stats
01
60% of phishing emails were delivered as attachments or links rather than plain text in 2022 (dataset-based classification in a peer-reviewed study).
02
76% of phishing emails contained obfuscated or suspicious URLs in 2021 (empirical measurement from an academic paper).
03
28% of spam messages included links to external domains in 2020 (spam content analysis reported in an academic study).
04
In 2024, 46% of surveyed organizations reported that email impersonation was a top concern (survey statistic in a market threat report).
05
In 2021, the mean phishing email lifetime (time from first observed to first taken down) was 24.6 hours (measurement study).
06
In 2020, researchers measured that 91% of spam emails included malicious links or were attached to malware delivery infrastructure (empirical content analysis).
Interpretation
Threat Landscape Interpretation
In the Threat Landscape, phishing and spam are increasingly delivered through active web and attachment tactics, with 60% of phishing using attachments or links in 2022 and 76% using obfuscated or suspicious URLs in 2021, while 91% of spam in 2020 involved malicious links or malware delivery infrastructure.
03 · Category
Threat Prevalence5 stats
01
A 2020 study in the ACM SIGCOMM/Internet measurement community found that a large fraction of global unsolicited email uses spoofed sending identities (Spoofing prevalence measured across collected traces).
02
Spam is the primary vector for credential theft in many phishing campaigns; a 2021 PhishLabs study reported that phishing and spam drove the majority of reported theft attempts (measured in their dataset).
03
In 2023, ESET telemetry showed that a high share of detected malicious emails used social engineering rather than attachment-based malware (ESET threat report).
04
In 2023, Cisco Talos reported that phishing attacks remain among the top malicious email categories detected in their telemetry (Cisco Talos).
05
In Verizon DBIR 2023, 74% of all breaches involved the use of stolen credentials (DBIR incident analysis).
Interpretation
Threat Prevalence Interpretation
Across recent research and incident reporting, threat prevalence in spam and phishing is driven largely by credential abuse with 74% of breaches in Verizon DBIR 2023 involving stolen credentials and multiple 2020 to 2023 studies showing that spoofed sending and social engineering remain common tactics in malicious email.
More related reading
04 · Category
Performance Metrics5 stats
01
In 2022, Google’s transparency report showed that its spam filters accounted for 90%+ of processed emails being auto-classified as spam before reaching inboxes for most users (classified share).
02
In 2024, Cloudmark (Proofpoint) reported that its anti-spam systems reduced spam reaching inboxes by 99% in customer environments (vendor claim with percentage).
03
In 2024, Ponemon/IBM reported that the average time to contain a breach was 72 days (IBM Cost of a Data Breach 2024).
04
In 2023, Google’s Safe Browsing report stated that it detected and blocked hundreds of millions of phishing pages daily (blocking count).
05
In 2022, Cloudflare reported that its email security product blocked 99.9% of spam and phishing attempts for protected customers (Cloudflare product metrics).
Interpretation
Performance Metrics Interpretation
Across the performance metrics, spam and phishing defenses are increasingly effective, with systems in 2022 to 2024 auto-classifying around 90% of emails as spam and blocking about 99% to 99.9% of threats, reflecting major gains in real world filtering performance and faster breach containment.
05 · Category
Cost Analysis3 stats
01
In 2022, the IC3/FBI reported 64,342 phishing incidents resulting in $52.0 million in losses (FBI Internet Crime Report).
02
In 2024, IC3 reported that 28,000+ non-business email compromises (N(B)EC) were reported with losses included in the BEC category totals (IC3 2023 report breakdown).
03
Spam-related fraud losses reached $1.2 billion globally in 2023 as reported by the cybersecurity insurance market analysis (industry publication).
Interpretation
Cost Analysis Interpretation
The cost impact of spam related threats is climbing, with phishing losses totaling $52.0 million in 2022, BEC related non business email compromises still driving reported losses in 2024, and spam related fraud losses reaching $1.2 billion globally in 2023.
06 · Category
Industry Overview3 stats
01
1 in 5 adults (20%) reported experiencing at least one phishing attempt in the past 12 months in 2023 (survey statistic reported by U.S. government).
02
In 2024, 58% of surveyed IT security professionals said they had experienced ransomware delivered via email within the last 12 months (survey-based finding in an industry report).
03
As of 2024, the DMARC adoption rate was 33% of all domains publishing DMARC (DMARC adoption metrics).
Interpretation
Industry Overview Interpretation
For the Industry Overview on spam related threats, recent data shows that 20% of adults faced phishing attempts in 2023, 58% of IT security professionals dealt with ransomware delivered by email in the past 12 months in 2024, and only 33% of domains publish DMARC, underscoring how widespread these email abuses remain.
report visual · Comparison
How often phishing/spam tactics show up (measured shares)
Measured shares show phishing content is often delivered via links/attachments, contains suspicious or obfuscated URLs, and spam commonly includes external-domain links.
76% of phishing emails contained obfuscated or suspicious URLs in 2021 (empirical measurement from an academic paper).76%
60% of phishing emails were delivered as attachments or links rather than plain text in 2022 (dataset-based classificati
60%
28% of spam messages included links to external domains in 2020 (spam content analysis reported in an academic study).
28%
source-verifiedieeexplore.ieee.org · arxiv.org · dl.acm.org2022
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Julian Richter. (2026, February 13). Spam Email Statistics. Gitnux. https://gitnux.org/spam-email-statistics
MLA
Julian Richter. "Spam Email Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/spam-email-statistics.
Chicago
Julian Richter. 2026. "Spam Email Statistics." Gitnux. https://gitnux.org/spam-email-statistics.
Sources & references
29 datasets cited across this report · attribution is report-level
+7 additional datasets cited (not shown individually)