Spear phishing: per-incident cost, attacker economics, the AI inversion

Spear phishing is the targeted, researched form of phishing in which the attacker addresses a specific individual using personalised content drawn from public sources. The category is conceptually older than bulk phishing (it predates the spam-filter era), but the cost profile changed materially in 2024 with the arrival of usable large language model output for lure generation. Two numbers anchor the 2026 picture: $1.76M per successful incident on the defender side, and a 54 percent click-through rate on AI-automated lures, matching human experts and far above the 12 percent arbitrary-phishing control.

The defender-cost figure is from Verizon's 2025 Data Breach Investigations Report, summing the median IR engagement, credential-reset cycle, downstream pivot containment, and data-loss notification spend for breaches where spear phishing was confirmed as the initial vector. The click-through figures are from a controlled Harvard study (Heiding, Lermen and Schneier, 2024), which ran a head-to-head test across fully AI-automated lures, expert human-written lures, and an arbitrary-phishing control group, holding target population and delivery channel constant. Fully automated AI lures reached a 54 percent click-through, on par with the human experts (also 54 percent) and roughly 350 percent above the 12 percent control group. The result is broadly consistent with later field measurements from NCSC UK and CISA.[Verizon DBIR 2025 + Heiding et al., Harvard 2024 (arXiv 2412.00586)]

For two decades, the defender relied on an implicit economic moat: spear phishing was expensive to produce. A credible lure required 30 to 90 minutes of human research time per target, building a believable pretext from LinkedIn profile data, public press releases, recent conference attendance, and any leaked email correspondence available on the underground market. At attacker labour rates of approximately $50 per hour in mature criminal markets, the cost-per-lure ran $25 to $75 with a baseline conversion rate of 8 to 14 percent. That implied a unit economics floor of approximately $180 to $500 per successful compromise, which was high enough that attackers reserved spear phishing for high-value targets only.

The 2024 LLM wave broke the moat from two directions. First, the marginal cost of generating a personalised lure dropped to under one cent of model-inference compute per lure. Second, the conversion rate climbed from the 8 to 14 percent baseline to over 50 percent in controlled tests because LLM-generated text carries none of the grammatical, syntactic, or register-shift tells that human-written non-native lures used to signal. The unit economics floor for spear phishing collapsed from approximately $300 per compromise to under one cent, a five-order-of-magnitude shift in attacker cost-per-acquisition. The implication for defenders is that the historic mental model of spear phishing as a low-volume, high-value attack category no longer holds. Spear-grade personalisation is now bulk-grade in unit economics.

The defender-side response is not to assume that filtering will catch the new generation of lures. It will not, because the lures are grammatically perfect and semantically coherent with the recipient's actual work context. The response is to invest in the controls that work regardless of lure quality: phishing-resistant FIDO2 MFA on every account, behavioural email security that flags anomalous-relationship sender patterns, and a hard rule that bulk credential-sensitive actions (password reset, MFA reset, payment redirection) require an out-of-band confirmation step. None of those controls depend on detecting that a lure is fake.[Heiding et al., Harvard 2024 + Verizon DBIR 2025 attacker economics annex]

Sub-line proportions extracted from the Verizon DBIR 2025 spear-phish initial-vector cohort. The downstream pivot containment line is structurally larger than for bulk phishing because the target was selected for privileged access; the access was therefore valuable to the attacker on day one rather than something they had to escalate to.[Verizon DBIR 2025 spear cohort]

Spear phishing cost varies more by the target's role than by the attack-pattern sophistication. A successfully-phished entry-level analyst costs the organisation in the high five-figures of credential cleanup; a successfully-phished platform-engineering tech lead with cloud-admin permissions costs the organisation in the high seven-figures of pivot containment. The role taxonomy below is modelled, cross-referenced with the SANS 2024 privileged-access study.

A working knowledge of where the personalisation inputs come from helps defenders prioritise the cheap controls. The single most-used OSINT source for spear-phish targeting is LinkedIn, which provides role, reporting line, recent posts, conference attendance, and the entire colleague graph for free with a $40 per month Sales Navigator subscription. Second is the corporate website plus SEC filings, which provide executive bios, financial-disclosure timing, and material-event references that anchor lure credibility. Third is GitHub commit history, which exposes engineering org structure, code-review relationships, and (frequently) accidentally-committed secrets that can be used to pre-validate the lure.

The defensive implication is that the attacker's OSINT cost is dominated by manual review time, and that LLM-assisted OSINT collapses the manual review cost to near zero. Two years ago an attacker could afford to spear-phish maybe 20 targets per week as a solo operator. Today the same operator with a usable LLM in their workflow can spear-phish 2,000 targets per week. The volume increase changes the defender threat model from selective-targeting to universal-personalisation. Defenders should now assume that every employee with a LinkedIn profile is in scope for a personalised lure, not just executives.

Public defenses against OSINT-harvested spear-phish remain weak. There is no realistic way to remove staff from LinkedIn, and corporate disclosure requirements force most of the underlying inputs into public view anyway. The pragmatic move is to assume the personalisation surface is permanent and invest defensive budget downstream in the controls that work after the lure lands: phishing-resistant MFA, behavioural email security, and a privileged-access architecture that minimises blast radius from any single compromised account.[NCSC UK OSINT assessment 2024 + Verizon DBIR 2025]

The control ranking for spear phishing is materially different from the ranking for BEC. The BEC ranking is dominated by procedural finance controls; the spear ranking is dominated by identity and architectural controls because the pivot path runs through compromised credentials rather than wire fraud.

Three reference incidents anchor the modern spear-phish cost discussion. Each illustrates a different attacker pivot path and a different defender failure mode.

First, the Snowflake-customer wave of 2024. Attackers compromised platform-engineering credentials (typically through info-stealer malware delivered via a spear-phish or a malvertising channel) and used those credentials to log into customer Snowflake tenants that lacked enforced MFA. AT&T, Ticketmaster, Santander, and approximately 160 other Snowflake customers were affected. The pivot path was textbook: spear-phish a target with cloud-admin permissions, exfil credentials, log in directly to the cloud control plane. Defender failure mode: MFA was not enforced on the cloud tenant, even though the upstream identity provider had it.

Second, the Microsoft Storm-0558 incident of 2023. Chinese state-actor adversaries used a stolen Microsoft consumer signing key to forge tokens against multiple US government Exchange Online tenants. The initial access vector was an earlier compromise that yielded the signing key; the spear-phish element was the targeted exfil of specific government inbox content via the forged tokens. The incident drove the CISA + FBI joint advisory on Microsoft 365 token-handling and the Microsoft Secure Future Initiative.

Third, the Okta support-portal compromise of 2023. Attackers used a spear-phish against an Okta support engineer to gain access to a session cookie that had visibility into customer-support cases, including HAR files containing valid session tokens for downstream customers. The incident cascaded through customers including 1Password, BeyondTrust, and Cloudflare. Defender failure mode: the support engineer's session cookie was not bound to their device, and the customer HAR files contained tokens that should have been stripped before upload.[Snowflake-customer wave + CISA/FBI Storm-0558 advisory + Okta Oct 2023 incident report]

• All phishing attack vectors
• BEC cost
• Whaling and CEO fraud cost
• AitM token-theft phishing cost
• AI-generated phishing cost
• Phishing cost in financial services
• Hoxhunt cost (AI-spear-phish defensive training)
• Abnormal Security cost
• databreachcost.com (post-breach cost)
• mdrcost.com (managed detection)