Complete Guide to Cybersecurity Awareness

Last year, scammers stole $12.3 billion through phishing schemes. That's more than Barbados generates in GDP annually. Here's what should worry you more: when researchers test company defenses with fake phishing emails, about 11% of recipients click anyway. And we're talking about employees who've sat through security training.

Even tech companies—places where everyone supposedly knows better—see 7% of their staff give up credentials to well-crafted fakes.

Why do these cons keep working? Attackers figured out something important years ago. You don't need sophisticated malware when you can trick someone into handing over their password. Psychology beats technology every time.

Let's examine what the numbers actually tell us.

Current Phishing Attack Rates and Trends

The Anti-Phishing Working Group counted 5.2 million distinct phishing campaigns in 2025. That's up from 3.88 million the year before—a 34% jump.

Break that down to daily numbers? Around 14,250 new campaigns start every single day.

Your company's email system probably sees about 1,185 phishing attempts monthly. Email filters catch most of them—roughly 3.4 billion got blocked last year across all systems. But 2.1% slip through anyway. Sounds small, right? Except that percentage translates to millions of malicious messages actually landing in inboxes.

Once there, 11.3% of people who see them click. Run those numbers for a 500-person company. You're dealing with approximately 67 dangerous clicks each month, assuming average expo...