Phishing facts

Key figures on phishing and human-driven breaches, with sources.

Every figure below links back to a named, published source so you can check it, quote it, or put it in a board report.

People are in most breaches

68% of breaches involved a non-malicious human element, such as someone falling for social engineering or making an error. Source: Verizon 2024 Data Breach Investigations Report (DBIR)

It happens fast

The median time for a user to fall for a phishing email is less than 60 seconds after opening it. Source: Verizon 2024 DBIR

Reporting is improving

In simulation exercises, 20% of users reported phishing, and 11% of users who clicked went on to report it. Source: Verizon 2024 DBIR

Phishing is the most-reported cybercrime

298,878 phishing and spoofing complaints were made to the FBI in 2023, more than any other category. Source: FBI Internet Crime Complaint Center (IC3), 2023 Internet Crime Report

Business email compromise is costly

Business email compromise led to $2.9 billion in reported losses in 2023. Source: FBI IC3, 2023 Internet Crime Report

Breaches are expensive

The global average cost of a data breach reached $4.88 million. Source: IBM Cost of a Data Breach Report 2024