Topic starter
11/11/2026 6:04 pm
TL;DR: Spear phishing drives outsized harm because Barracuda found it accounts for under 0.1% of email but 66% of breaches. Post-delivery detection and response are the bottleneck, so mailbox and account controls have to assume compromise can outpace human review.
Editorial analysis by NHI Mgmt Group, based on content published by Barracuda: “2023 spear-phishing trends”.
By the numbers:
- 50% of organisations were victims of spear phishing in the last 12 months.
- 22% of organisations had at least one email account compromised in 2022.
- Compromised accounts sent an average of 370 malicious emails.
Key questions
Q: Why does spear phishing so often lead to account compromise?
A: Spear phishing often leads to account compromise because it targets a named user with a believable message, then steals credentials, pushes a malicious sign-in page, or tricks the user into approving MFA.
Q: How can mailbox compromise spread across an organisation?
A: Mailbox compromise spreads when attackers use the stolen account to send convincing messages to contacts, harvest replies, and launch follow-on lures from a trusted internal address.
Q: How do organisations detect spear phishing before account takeover?
A: Effective detection looks for both message-level and account-level signals.
Practitioner guidance
- Strengthen mailbox compromise detection Monitor for anomalous forwarding rules, impossible travel logins, unusual OAuth consent events and unexpected outbound spikes from user mailboxes.
- Shorten account recovery windows Require rapid session revocation, password reset and token invalidation when a mailbox shows signs of compromise, rather than relying on password change alone.
- Harden user verification for high-risk requests Use secondary verification for password resets, wire instructions and approval requests that arrive by email, especially when the request is time-sensitive.
Bottom line: Spear phishing remains a high-impact identity threat because a small share of email traffic can still drive a large share of breaches and account compromise.
Glossary terms: Spear Phishing, Account Takeover, Mailbox Rule Abuse, Post-delivery detection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Spear phishing is a low-volume, high-yield identity attack: Barracuda's figures show that campaign size is a poor proxy for risk. The more useful measure is how often a single successful lure turns into account compromise, data loss or a second-stage internal campaign. Practitioners should treat email identity abuse as a breach precursor, not a nuisance event.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: What is the best way to cut the damage from a compromised email account?
A: The best way to cut the damage from a compromised email account is to revoke the account’s active sessions, reset the password, and invalidate any refresh tokens or app passwords. Then review mailbox rules, forwarding settings, delegated access, and recent sign-ins to remove persistence and spot further abuse.
👉 Read our full editorial: Spear phishing is rare in volume but drives most breaches