AI-powered phishing is still driving the costliest breaches

At a glance

What this is: This analysis of IBM’s 2025 breach data shows phishing returning as the leading initial attack vector, with AI accelerating attacker output and extending the cost of slow detection.

Why it matters: For IAM, NHI, autonomous, and human identity programmes, it shows that identity trust signals must be paired with behavioural and contextual controls because inbox abuse still drives some of the most expensive breaches.

By the numbers:

• Phishing is again the most common initial attack vector, accounting for 16% of incidents analyzed.
• Generative AI has reduced the time to write a convincing phishing email from as long as 16 hours to just 5 minutes.
• Breaches identified and contained in under 200 days averaged $3.87 million, while those that lingered past 200 days cost $5.01 million.

👉 Read Abnormal AI’s analysis of IBM’s 2025 breach findings on AI-driven phishing

Context

Phishing remains a human identity problem with direct control-plane consequences. When email is the entry point, attackers are not only trying to get a click, they are trying to inherit trust, impersonate a vendor, or turn a mailbox into a launchpad for payment fraud and lateral movement.

The 2025 breach data shows why traditional awareness training and static filtering are not enough on their own. The pattern now spans human identity abuse, vendor impersonation, and account takeover, which means security teams need governance that correlates behaviour, relationship context, and response speed across identity programmes.

Key questions

Q: How should security teams reduce phishing risk without relying only on awareness training?

A: They should combine user training with behavioural detection, vendor verification, and tighter controls on high-risk identity actions. Awareness helps users spot obvious lures, but it does not stop impersonation that looks routine. The stronger model is to detect trust abuse across mail, identity, and workflow layers before approval or credential use occurs.

Q: Why do phishing and account takeover keep driving expensive breaches?

A: Because attackers use trusted identities to bypass suspicion and then abuse the resulting access for financial fraud, data theft, or persistence. The cost rises when the compromise is discovered late, when vendor relationships are hijacked, or when the attacker can move through normal business processes without immediate resistance.

Q: How can organisations tell whether their phishing controls are actually working?

A: Look at containment speed, identity revocation speed, and whether suspicious messages are being linked to downstream workflow abuse. If alerts stop at the email gateway but not at mailbox behaviour, vendor changes, or payment activity, the control set is missing the real attack path.

Q: Who is accountable when a phishing attack turns into vendor fraud or account takeover?

A: Accountability usually spans security, IAM, finance, and business process owners because the breach crosses identity and operational boundaries. The critical question is not only who clicked, but who owned the workflow that allowed a trusted request to become a validated action.

Technical breakdown

Why phishing still beats static email controls

Phishing works because it exploits identity expectations, not just malicious payloads. Attackers mimic familiar senders, routine requests, and expected timing so messages appear legitimate inside normal business workflows. That makes simple rule-based filtering brittle, because the malicious content can be benign-looking while the intent is fraudulent. When generative AI lowers the effort required to personalise messages, attackers can scale social engineering without sacrificing plausibility. The technical problem is therefore not only delivery, but trust abuse across mailbox, vendor, and payment processes.

Practical implication: security teams need behavioural detection and identity-aware email controls, not just keyword filters and attachment scanning.

How AI changes attacker throughput in phishing campaigns

Generative AI compresses the attacker’s content-creation cycle from hours to minutes, which changes phishing from a craft activity into a throughput problem. That speed lets attackers test more lures, iterate more quickly, and tailor language to the target’s role, region, or current business event. The result is more convincing pretexting at much larger scale. This does not mean the AI is the breach cause by itself. It means AI removes one of the old friction points that used to limit campaign volume and quality.

Practical implication: defenders should expect higher-volume, more personalised attacks and tune detections for anomaly patterns, not just malicious phrasing.

Why containment time now drives breach cost

IBM’s data ties cost to time because the longer a compromise persists, the more systems, identities, and records an attacker can reach. Slow detection increases extortion leverage, recovery effort, and the chance that third parties or regulators discover the incident first. This is especially costly in vendor compromise and account takeover scenarios, where abuse can look operationally normal until funds move or data leaves. The technical lesson is that compromise window length is a cost multiplier, not just an incident metric.

Practical implication: shorten triage and containment loops around identity misuse, mailbox compromise, and vendor trust changes.

Threat narrative

Attacker objective: The attacker aims to convert trusted communication into credential access, financial fraud, or broader breach persistence with minimal visible resistance.

1. Entry begins with a convincing phishing message or vendor impersonation that reaches a trusted inbox and bypasses user suspicion.
2. Escalation occurs when the recipient clicks, shares credentials, or approves a routine-looking request that gives the attacker mailbox or account access.
3. Impact follows through account takeover, payment redirection, data theft, or supply chain abuse that can remain hidden for months.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• DeepSeek breach — DeepSeek breach exposed 1M+ log lines and sensitive secret keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing is now an identity governance problem, not just an email security problem. The IBM data shows that the real damage comes when a trusted identity channel is abused to impersonate a person, a vendor, or a routine business process. That puts IAM, PAM, and human behaviour controls in the same threat model as email security. Organisations that still treat phishing as an inbox-only issue are managing the symptom, not the governance failure.

Behavioural trust has become the decisive control surface. Static identity evidence such as sender name or known contact history no longer separates legitimate from malicious activity with enough confidence. The named concept here is identity-context drift: the point at which a message still looks ordinary while its behaviour, timing, or payment instruction no longer matches established relationships. Practitioners need to treat that drift as a detection problem across communication, identity, and workflow layers.

Time to detection is the hidden breach accelerator. IBM’s cost curve shows that breaches lasting longer than 200 days carry a clear financial penalty, which means containment speed is now a governance metric as much as an incident-response metric. This affects everything from alert triage to identity revocation, because delayed action lets attacker control compound across inboxes, accounts, and vendors. Teams should measure response latency as part of identity risk management, not only as SOC performance.

AI changes the economics of both attack and defence. The same technology that helps attackers generate more convincing phishing also helps defenders detect behavioural anomalies faster when it is embedded in security operations. That is why AI governance cannot be separated from identity governance. The organisations that treat AI as a control multiplier across the security lifecycle will close the gap faster than those relying on awareness alone.

Vendor compromise and account takeover are the breach multipliers that make phishing expensive. The report’s cost data shows that the highest-impact incidents are often not the first click, but the downstream abuse of inherited trust and credentials. That means phishing maturity has to be measured by what happens after initial access: whether accounts are contained, vendor relationships are validated, and abnormal payment or data-access behaviour is interrupted quickly.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
• For a broader breach lens, the 52 NHI Breaches Analysis shows how identity abuse persists across access paths and why lifecycle controls matter.

What this signals

Identity-context drift: teams should expect more attacks that look legitimate in isolation but fail once message intent, sender behaviour, and workflow timing are correlated. That makes identity telemetry and business-process telemetry equally important for email defence, especially where payment or supplier changes are involved.

With 72% of organisations already reporting or suspecting NHI breaches in our research, the broader identity surface is clearly under pressure. The lesson for practitioners is to stop treating email compromise as a separate problem and start measuring how quickly identity misuse is detected, contained, and removed from downstream processes.

Abnormal AI’s analysis reinforces a programme-level shift that many teams still underweight: inbox security now sits inside the identity control plane. For practitioners, that means vendor verification, conditional access, and behaviour analytics need to be aligned rather than managed as isolated tools.

For practitioners

• Correlate mailbox behaviour with identity context Flag unusual sender patterns, travel context, payment changes, and relationship drift together so suspicious requests can be reviewed before approval or forwarding becomes a breach path.
• Tighten controls around vendor-facing workflows Require step-up checks for payment changes, bank detail updates, and vendor contact changes, especially where a trusted mailbox could be used to impersonate a supplier.
• Measure identity misuse containment speed Track time from first suspicious message to mailbox lockdown, token revocation, and vendor verification so response latency becomes a managed risk indicator.
• Use AI in detection pipelines with clear governance Apply AI to message clustering, relationship mapping, and anomaly detection, but keep human review for high-risk identity actions such as payments and privileged access changes.

Key takeaways

• Phishing remains a high-cost identity abuse pattern because attackers can turn trusted communication into account takeover, vendor fraud, or data theft.
• The cost of breach increases sharply when detection is slow, which makes containment speed a governance metric and not only a SOC metric.
• Teams should combine behaviour analytics, workflow validation, and identity controls to interrupt impersonation before it becomes an expensive incident.

Key terms

• Identity-context drift: The point at which a message, request, or interaction still looks normal to users but no longer matches established identity behaviour. In practice, this is where phishing becomes dangerous because the attacker borrows familiarity while changing the underlying intent or action path.
• Vendor impersonation: A social engineering pattern where an attacker pretends to be a trusted supplier, partner, or service provider to gain approval, payment, or access. The risk is amplified when business processes trust the relationship more than the message behaviour or transaction context.
• Account takeover: Unauthorised control of a user or service account after credentials, session access, or approval flows are compromised. For identity teams, the concern is not only access loss but the attacker’s ability to use legitimate pathways that already carry trust and business authority.
• Behavioural detection: A detection approach that looks for deviations in communication patterns, access habits, and workflow activity rather than relying only on signatures or static rules. It is especially relevant when attacks are personalised and crafted to resemble ordinary business activity.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by Abnormal AI: IBM Cost of a Data Breach Report 2025 analysis. Read the original.