2026 Enterprise Email Phishing Attack Statistics and Practical Defense Recommendations

The “Evolution” of Phishing: Why Traditional Defenses Are Failing

Before 2019, phishing emails were fairly easy to recognise: grammatical errors, unfamiliar senders, .exe attachments. An email administrator could block most attacks simply by configuring a spam filter. But since 2024, attackers have learned corporate defenses inside out. They no longer mass-mail; they run targeted campaigns against specific roles. That shift has made phishing dramatically harder to identify: the message looks entirely normal and the sender’s identity shows no flaws. This year we handled a real phishing incident. A client’s finance director received an email from a “supplier” chasing a final payment. The address read supplier@companyname.com, differing from the genuine supplier’s domain by a single letter. The finance staff thought nothing of it and wired the money to the account details given in the email. Three days later the real supplier called to chase payment, and only then did the truth come out. This attack relied on no malware and no malicious links, only on a relationship of trust and social engineering. That is the hallmark of BEC (Business Email Compromise).

From SPF to DMARC: How to Configure Email Authentication the Right Way

Many companies’ mail server configurations are stuck a decade in the past, with only a basic SPF record enabled. Even more absurd, some IT administrators set SPF to “softfail”, meaning “if authentication fails, let the message through anyway, just flag it”. A configuration like that is tantamount to hanging a dummy CCTV camera at the mail gateway. How SPF works is not complicated: it tells the receiving server that only the IPs on the list are authorised to send mail on behalf of your domain. But SPF validates only the sending server, not the sender’s identity, and that is the gap DKIM fills. DKIM effectively attaches a digital signature to the message, so the recipient can use a public key to verify whether the content was altered in transit. The catch is that the private key behind a DKIM signature must be carefully safeguarded; once it leaks, attackers can forge mail that looks entirely legitimate. DMARC is the enterprise-grade approach that ties SPF and DKIM together. Organisations can choose among three policies: none (monitor only), quarantine (isolate suspicious mail) and reject (refuse outright). Companies in a position to do so should set their domain’s DMARC policy to p=reject. That not only blocks forged mail but also sends attackers a clear signal: this domain is protected.

1. SPF configuration: authorise only your company mail servers’ IPs and remove outdated third-party mail service IPs;
2. DKIM configuration: use a 2048-bit RSA key and rotate the signing key regularly;
3. DMARC policy: start with p=none for two weeks of observation, step up to p=quarantine, and finally set p=reject.

One caveat: email authentication protocols only defend against domain spoofing. They cannot stop attackers from using lookalike domains (swapping the letter l for the digit 1, for example). Beyond technical controls, staff awareness matters just as much.

Employee Training: More Than Sending a Few Simulated Phishing Emails

Security training at many companies is still stuck in watch-a-video, take-a-quiz mode. Employees complete it only to satisfy compliance requirements, and three months later they have long forgotten the content. Effective awareness education has to simulate real scenarios, not dry bullet points on a slide. We recommend sending one simulated phishing email a month, but the content must be carefully designed; it cannot be the kind of fake that is obvious at a glance. Simulate an urgent task from a manager outside working hours, or an invoice link from a supplier. After each simulation, employees who take the bait receive immediate feedback telling them what went wrong and how to spot it. After six months of continuous training, one manufacturing client saw its employee phishing click-through rate fall from 23% to 4%. The priority audiences are finance and procurement, precisely the departments BEC fraud targets. Training should cover this: verifying payment details by phone is standard procedure, and any urgent payment request must be confirmed by phone. If you would like to learn more about end-to-end enterprise network security solutions, see our Network Equipment Package page. If attackers have already obtained credentials for certain accounts, the first step is to revoke all active sessions and force a password reset, then check whether mail forwarding rules have been tampered with. This is a favourite persistence technique of attackers. Some advanced attacks set up automatic forwarding rules that quietly copy every incoming message to the attacker’s mailbox; left undiscovered, such a backdoor leaks sensitive information continuously. A final point: email security is not something you can buy a set of appliances and consider solved. It takes technical controls, process management and staff awareness working together. Many companies spend heavily on firewalls and sandboxes while employees still use 123456 as a password and approvals still travel as WeChat screenshots. Those details are where security actually falls short.