Phishing, Still the #1 Threat: How to Spot and Report Attacks

Despite historic investment in cyber defenses, phishing remains the leading cause of breaches in 2025, consistently outmaneuvering technical controls with creativity, speed, and AI-driven sophistication. Attackers are more prolific and effective today than ever: organizations reported a 17% increase in phishing attempts and a 47% rise in attacks that evade Microsoft and secure email gateways just this year.

AI is supercharging phishing attacks, enabling threat actors to generate highly personalized, convincing messages at scale—82% of phishing emails now leverage AI-generated content. The result? Even well-trained employees and seasoned IT pros are fooled by increasingly subtle and believable scams.

Why Phishing Remains So Successful

• The human element is involved in 68% of breaches, and nearly 95% of those start with a phishing email.
• The average cost of a phishing breach has surged to $4.88 million in 2025, one of the largest year-over-year increases on record.
• Ransomware remains tightly coupled with phishing: 54% of ransomware infections begin with a malicious email, while poor user practices and lack of security awareness contribute directly to successful attacks.

Compounding the problem, attackers impersonate the brands and platforms organizations trust the most—Microsoft, DocuSign, HR platforms, using social engineering lures themed around expiring credentials, urgent document reviews, or “critical” payroll updates.

The Cost and Risk of Untrained Staff

The latest industry benchmarking shows that a third of employees (33.1%) are susceptible to clicking on phishing or social engineering emails in a baseline test. Some verticals fare far worse: healthcare, insurance, and retail lead with susceptibility rates above 36–41%. Just 90 days of focused security awareness training drops organizational risk by over 40%, and a year later by up to 86%—from roughly 1 in 3 failures to as low as 4 in 100.

How to Spot a Phishing Attack in 2025

Even with advanced threat controls, some malicious messages slip through. Modern phishing detection relies on user vigilance and fast reporting. Here’s how to spot the red flags:

• Scrutinize sender addresses for subtle misspellings or inconsistent domains—organizations are being spoofed at record rates.
• Be wary of urgent requests (“your account will be locked in 24 hours!”), generic greetings, and grammatical oddities—even AI can craft errors.
• Hover over all links to preview their true destination; over 90% of malicious attachments actually contain hidden links to credential stealers or malware.
• Do not open unexpected or suspicious attachments and avoid clicking links until you are sure of their authenticity.
• If in doubt, use official channels to verify requests and NEVER reply directly to suspicious messages.

What Works: Training, Simulation, and Quick Reporting

Adaptive phishing simulations and behavior-based training can reduce incidents by 86% in less than a year, transforming employees from the weakest link to the organization’s strongest defense. Reporting rates soar in engaged cultures, speeding threat detection and response: in companies using advanced, personalized security awareness programs, real phishing incidents per 1,000 employees have dropped from 466 to under 75 annually.

The Stakes: Fast Reporting Saves Millions

Speed matters. There is a $1.2 million cost differential between phishing breaches contained in 200 days or less versus slower detection. Organizations with well-trained users not only avoid breaches, but they also respond faster and contain incidents before business is severely impacted.