Enterprise Data Compromised Image

Phishing is the bane for most CISOs. However, how big of a problem is it in reality?

We’ve compiled a set of facts regarding the impact of phishing on enterprises. As expected, it isn’t a pretty picture … and calls into question vendors who claim “holy grail” solutins with “99.9% or better” detection rates.

Scope and Impact

  • Globally in 2024, phishing-related financial losses reached approximately $17.4 billion, up 45% year over year, with data breach costs averaging $4.88 million per incident (Axios, NordVPN).

  • In the U.S., average phishing‑related breach costs had climbed to $4.17 million, with SMBs losing about $328,000 per incident. For enterprises, downtime costs reached $9,500 per minute (SQ Magazine).

  • Organizations lose an average of $4.65 million per phishing attack (Broadband 4 Europe).

  • Phishing was the most preferred attack vector for 65% of cybercriminals (Broadband 4 Europe).

  • In 2025 alone, phishing‑related fraud caused $6.8 billion in business losses in H1 (SQ Magazine).

Why Phishing Is Hard for Enterprises to Beat

1. AI‑Powered Scale & Sophistication

  • Cost‑effective generative AI tools have enabled a ~70% jump in email scams between 2023 and 2024; AI‑powered phishing now accounts for 82–83% of phishing emails (TechRadar).

  • Attackers craft typo‑free, personalized, polymorphic emails that evade signature‑based systems (TechRadar).

  • Business Email Compromise (BEC) using AI‑generated deepfakes or mimicry is rising rapidly—executives are prime targets, with losses now averaging $4.9 million per breach in 2024 (strongestlayer.com, Financial Times, SQ Magazine).

2. Phishing‑as‑a‑Service (PhaaS)

  • Between Jan–Feb 2025, over 1 million PhaaS attacks were observed, with Tycoon 2FA accounting for ~89% of those attacks (Barracuda Blog).

  • These kits now include built‑in 2FA bypass, evasion tools, and detection‑resistance against security inspection (Baraccuda Blog).

3. Legacy Technical Controls Struggling

  • Traditional Secure Email Gateways (SEGs) and blocklists are failing more often; 47% of attacks now evade Microsoft’s native defenses (KnowBe4).

  • Nearly 90% of organizations reporting phishing incidents still had SEGs in place, yet attackers bypass them via HEAT tactics—Highly Evasive Adaptive Threats—in which malicious links mimic trusted URLs undetected (Wikipedia).

4. Human Risks

Strategic Recommendations for Enterprises

Most veteran cybersecurity professionals are aware of the following, but we’ve included them for completeness sake. The key takeaway is that there is no single solution that will suffice, despite numerous vendors claiming their solution is the “holy grail”. The best approach is still to take a layered defense strategy to mitigate the risks.

Layer Recommended Approach
1. Technical Enforce SPF/DKIM/DMARC with reject policies where possible. Adopt Zero Trust Security and real‑time anomaly detection. Deploy advanced ML & AI‑based detection for web traffic inspection.
2. Human Risk Implement ongoing, simulated phishing training with behavior coaching. Measure PPP and target high‑risk groups monthly.
3. Authentication Adopt phishing‑resistant MFA like WebAuthn where possible; monitor session‑token usage and logins.
4. Threat Intelligence Share phishing trends, indicators, and PhaaS campaign data via industry‑specific threat sharing consortia.
5. Incident Response Build a robust phishing‑incident response plan: prompt reporting, containment, credential resets, and forensic review.

Final Thoughts

Phishing remains one of the fastest‑moving, highest‑cost threats facing enterprises today. Exploiting human vulnerability and powered by AI and PhaaS platforms, phishing attacks are escalating in volume and sophistication. Traditional defenses alone no longer suffice.

However, a layered, adaptive strategy—combining sustained security awareness training, robust email authentication, advanced behavioral detection, and phishing‑resistant authentication—can dramatically reduce risk over time. Enterprises that commit to both the human and technical layers of defense can turn the tide in their favor.

Within this layered approach, a new method that is gaining traction: Browser-Based detection. While it is also not a “holy grail” solution, it can offer complementary protection to traditional security solutions and thus get us closer to a phishing-free world.

Next steps

Try Sekant Web Security

If this article piqued your interest, please check out Sekant Web Security. It is a browser extension that applies machine learning and AI to detect phishing websites in real-time without relying on remote servers that compromise your privacy.

Some key features of Sekant Web Security:

  • Trained and tested on over a million datapoints

  • Multi-modal engine that analyzes URLs, HTML content, site reputation and brand elements

  • Automatically personalizes itself to individual browsing habits

  • Full user privacy; no user data sent to Sekant servers

  • Free for personal use

Explore the Sekant Blog for more articles related to phishing detection

Message us with thoughts

Have thoughts to share on phishing detection? Send us a note! info (at) sekantsecurity (dot) com

Attribution: Image courtesy of Freepik. Content written with Generative AI support.