Question 1

How much does a phishing attack cost a company?

Accepted Answer

Per IBM Cost of a Data Breach 2025, the average breach with phishing as the initial vector costs $4.80 million, against a $4.44 million global all-vector average. Breaches via stolen or compromised credentials average $4.67 million. The total includes direct incident response, business disruption, data breach liability, regulatory fines, and customer churn.

Question 2

What percentage of data breaches start with phishing?

Accepted Answer

Phishing is the most common initial access vector. Verizon DBIR 2025 attributes a substantial share of breaches to social engineering, with phishing the dominant subcategory. Industry guidance commonly cites that 90 percent or more of cyber attacks begin with a phishing email.

Question 3

How long does it take to detect a phishing breach?

Accepted Answer

IBM 2025 reports 254 days as the average to identify and contain a phishing-driven breach. Breaches with a lifecycle over 200 days cost approximately $1.1 million more than those contained sooner ($5.01M vs $3.87M in IBM 2025). Active disruption following detection typically runs 72 hours.

Question 4

What are the hidden costs of a phishing attack?

Accepted Answer

Beyond direct response and forensics, phishing carries hidden costs including reputation damage, customer churn (around 8 percent post-breach), insurance premium increases, executive time, IT overtime, legal fees, and class-action exposure (averaging $2.1 million for breaches that trigger litigation).

Question 5

Which industries face the highest phishing cost?

Accepted Answer

Healthcare leads at $7.42 million average breach cost (IBM 2025), the highest of any sector for the 14th consecutive year, followed by financial services at $5.56 million. Both sit well above the $4.44 million cross-industry mean. Manufacturing and retail run lower per-record but suffer high disruption cost.

Question 6

What is BEC and why is it so expensive?

Accepted Answer

Business Email Compromise (BEC) is a phishing variant where the attacker spoofs or compromises an executive or vendor mailbox to redirect a wire payment. FBI IC3 reported $2.77 billion in US BEC losses for 2024 across 21,442 complaints. Per-incident cost is high because the loss is typically a direct wire transfer rather than a recoverable IT asset.

Initial vector	Avg cost	Median dwell	Share of breaches
Phishing	$4.80M	254 days	16%
Third-party / supply chain compromise	$4.91M	267 days	15%
Stolen / compromised credentials	$4.67M	246 days	n/a
Malicious insider	$4.92M	260 days	n/a
Denial-of-service	$4.41M	236 days	n/a
Vulnerability exploitation	$4.24M	245 days	n/a

How much does a phishing attack actually cost?

Size your annual phishing exposure

Per-organisation incident cost estimator

Where the money goes when a phish lands

Six anatomy lines of a phishing incident

Direct loss

Forensics + IR

Regulatory fines

Litigation

Notification

Reputation / churn

Phishing against the rest of the threat ledger

Average breach cost by initial vector

Drill into the file

Questions security leaders ask before the board meeting

FAQ as filed

Building around your phishing defence?