Osterman Research - The (Higher) Business Cost of Phishing.

Three years ago, Osterman Research put a price on phishing. Then ChatGPT launched.

Based on survey data from 128 IT and security professionals at mid-to-large organizations, this report tracks how the phishing burden has changed since 2022, what AI has done to both sides of the fight, and what it will cost you if defenses don’t keep pace.

Key Findings

Phishing Now Costs $51,948 Per Analyst
That's a 13.6% jump since 2022. The full breakdown by role is in the report.
The AI Paradox Hit Defenders Hard
Per-incident handling got faster. Aggregate hours got worse. The report explains why.
Phishing Concern Has Climbed (even further)
Half of organizations now rate phishing as a high or extreme threat. In 2022, it was one third.
Deepfakes Have Moved from Theoretical to Disruptive
62.5% of organizations expect deepfakes to significantly increase phishing response time.

A Unified Approach to Email Security

Protect your employees’ inboxes from advanced phishing attacks that others miss, with the only technology that combines AI and human insights. Our platform is quick to deploy and dead simple to manage (so you get instant protection).

Protect Better

Block advanced phishing and BEC attacks (and never seen before threats) with our Adaptive AI—dynamically sharpened by real-world user insights and a community of over 25,000 threat hunters.

99.7% THREATS

25,000+ ANALYSTS

Automatically Remediated by AI

Collectively Threat Hunting

Simplify Operations

Slash the time your team spends remediating email incidents from 30 minutes per incident to 30 seconds. Our Adaptive AI scans every email for malicious indicators. When it finds a threat, it doesn’t just block it, it automatically finds and remediates all others like it in your environment.

“IRONSCALES has cut the number of man hours down by 95%.”

Empower your Org

Triple the email security awareness of your workforce and transform your employees into a crucial line of phishing defense. We make it dead simple to sharpen your employees’ understanding of real-world threats with:

Phishing simulation testing
Security awareness training (SAT)
Dynamic email banners

…and a GPT-powered chat assistant

Phishing has become a greater threat to more organizations
Phishing is a larger priority to more organizations in 2025 compared to our previous research in 2022. On average, half of organizations rank phishing as a “high threat” or “extreme threat,” compared to one third in 2022.
AI-enabled phishing is worsening the threat environment
Attackers are leveraging AI to gain significant advantage over defenders, resulting in more phishing attacks at a faster cadence that evade defenses.
Defenses catch obvious phishing threats—not the new sophisticated ones
New sophisticated phishing threats exploit trust and manipulate legitimacy to slip through defenses and catch employees unaware, including internal phishing from compromised colleagues, post-delivery weaponization of malicious links, and generative AI to create emails that impersonate the CEO.
Organizations got faster at fighting phishing. It hasn’t helped enough yet
AI-powered defenses have reduced the phishing burden per incident, but thanks to AI making it easier for attackers to automate and scale phishing attacks, incident volume grew at a faster (and in some cases, exponential) rate.
Deepfake attacks are immediately disruptive for 62.5% of organizations
Most organizations are not ready to protect against the use of AI-enabled voice and video deepfake technologies by threat actors, nor employees to differentiate between an actual voicemail from their CEO and a deepfake one.