Question 1

What is the average cost of a phishing attack in 2026?

Accepted Answer

According to IBM Security's 2025 Cost of a Data Breach report, the average cost of a phishing-initiated data breach is $4.88 million. This includes direct costs (forensics, incident response, legal), business disruption, data breach liability, regulatory fines, and customer churn. Phishing remains the most common initial attack vector, responsible for 16% of all data breaches.

Question 2

How common are phishing attacks?

Accepted Answer

Over 90% of organisations experienced phishing attacks in 2025 (Proofpoint). Approximately 3.4 billion phishing emails are sent worldwide every day. The APWG recorded 3.8 million phishing attacks in 2025. Phishing is the number one initial attack vector for data breaches globally.

Question 3

Which industries are most targeted by phishing?

Accepted Answer

Financial services is the most targeted sector, receiving 23.5% of all phishing attacks (APWG 2025). Healthcare has the highest average breach cost at $9.77 million, more than double the global average. Other heavily targeted sectors include technology, government, and education.

Question 4

How can organisations reduce phishing costs?

Accepted Answer

The most cost-effective defence is monthly security awareness training with simulated phishing, which reduces click rates by up to 70% within 12 months. Every $1 spent on training saves approximately $40 in breach costs (Proofpoint 2025). Layering training with phishing-resistant MFA (FIDO2/passkeys), email security gateways, and DMARC authentication provides defence in depth.

Question 5

What are the hidden costs of a phishing attack?

Accepted Answer

Beyond direct incident response costs, phishing attacks carry significant hidden costs: business disruption averaging $17,700 per minute of downtime, regulatory fines (GDPR up to 4% of annual revenue), customer churn (33% of customers leave after a breach), increased insurance premiums, and reputational damage that can take years to recover from. The average detection time for a phishing breach is 254 days.

Question 6

How long does it take to detect a phishing breach?

Accepted Answer

The average time to identify and contain a phishing breach is 254 days according to IBM Security's 2025 report. This extended dwell time significantly increases the total cost. Organisations with security awareness training and automated detection tools reduce this time by an average of 54 days, saving approximately $2.5 million in breach costs.

Attack Vector	Avg Breach Cost	Frequency	2026 Trend
Phishing	$4.88M	Most common (16% of all breaches)	Rising
Ransomware	$5.13M	High (11% of breaches)	Rising
Business Email Compromise	$4.67M	High ($2.77B US losses)	Rising
Insider Threat	$4.99M	Moderate (6% of breaches)	Stable
Stolen Credentials	$4.81M	High (15% of breaches)	Rising

How Much Does a Phishing Attack Cost in 2026?

Your Organisation

Cost Breakdown by Category

What Does a Phishing Attack Actually Cost?

How Phishing Costs Compare