Question 1

How much does a phishing attack cost a company?

Accepted Answer

Per IBM Cost of a Data Breach 2025, the average breach with phishing as the initial vector costs $4.88 million. Business Email Compromise (BEC) averages $4.67 million per incident. Smaller organisations face $3.31 million average breach cost. The total includes direct incident response, business disruption, data breach liability, regulatory fines, and customer churn.

Question 2

What percentage of data breaches start with phishing?

Accepted Answer

Phishing is the most common initial access vector. Verizon DBIR 2025 attributes a substantial share of breaches to social engineering, with phishing the dominant subcategory. Industry guidance commonly cites that 90 percent or more of cyber attacks begin with a phishing email.

Question 3

How long does it take to detect a phishing breach?

Accepted Answer

IBM 2025 reports 254 days as the average to identify and contain a phishing-driven breach. Breaches detected after 200 days cost approximately $1.2 million more than those caught earlier. Active disruption following detection typically runs 72 hours.

Question 4

What are the hidden costs of a phishing attack?

Accepted Answer

Beyond direct response and forensics, phishing carries hidden costs including reputation damage, customer churn (around 8 percent post-breach), insurance premium increases, executive time, IT overtime, legal fees, and class-action exposure (averaging $2.1 million for breaches that trigger litigation).

Question 5

Which industries face the highest phishing cost?

Accepted Answer

Healthcare leads at $9.77 million average breach cost (IBM 2025), followed by financial services at $5.9 million. Pharmaceutical and energy sectors also exceed the cross-industry mean. Manufacturing and retail run lower per-record but suffer high disruption cost.

Question 6

What is BEC and why is it so expensive?

Accepted Answer

Business Email Compromise (BEC) is a phishing variant where the attacker spoofs or compromises an executive or vendor mailbox to redirect a wire payment. FBI IC3 reported $2.77 billion in US BEC losses for 2024 across 21,442 complaints. Per-incident cost is high because the loss is typically a direct wire transfer rather than a recoverable IT asset.

Initial vector	Avg cost	Median dwell	Share of breaches
Phishing	$4.88M	254 days	16%
Stolen / compromised credentials	$4.81M	292 days	15%
Cloud misconfiguration	$4.00M	241 days	11%
Malicious insider	$4.99M	216 days	7%
Ransomware (post-access)	$5.13M	230 days	~10%
Business email compromise (BEC)	$4.67M	266 days	~7%

How much does a phishing attack actually cost?

Size your annual phishing exposure

Per-organisation incident cost estimator

Where the money goes when a phish lands

Six anatomy lines of a phishing incident

Direct loss

Forensics + IR

Regulatory fines

Litigation

Notification

Reputation / churn

Phishing against the rest of the threat ledger

Average breach cost by initial vector

Drill into the file

Questions security leaders ask before the board meeting

FAQ as filed