Topic starter
27/06/2026 2:03 pm
TL;DR: IBM’s Cost of a Data Breach Report 2025 says phishing again leads breach entry at 16% of incidents, with average costs of $4.8 million and 254 days to detect and contain, while generative AI cuts phishing email creation from 16 hours to 5 minutes according to Abnormal AI. The lesson is that behaviour-driven detection and faster containment now matter more than static email filtering alone.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “IBM Data Breach Report 2025: The Soaring Cost of Email Attacks”.
By the numbers:
- Phishing again accounts for 16% of incidents analyzed and averages 254 days to detect and contain.
- Generative AI reduced the time to write a convincing phishing email from 16 hours to just 5 minutes.
- Organizations that used AI and automation extensively reduced breach costs by nearly $1.9 million and contained incidents 80 days faster.
Key questions
Q: Why do AI-generated phishing attacks defeat traditional awareness training?
A: They remove the visual clues that old training relied on, such as spelling errors, odd domains, and obviously fake urgency.
Q: When do vendor impersonation and account takeover become the biggest breach risk?
A: They become highest risk when trusted relationships are allowed to operate without a second trust check.
Q: What are the signs that a phishing investigation process is failing?
A: A failing phishing process usually shows up as long triage times, heavy portal switching, inconsistent verdicts, and backlog growth faster than analysts can clear it.
Practitioner guidance
- Tighten behavioural detection on email and vendor workflows Correlate sender history, conversation context, payment changes, and post-click identity activity so a believable message is not treated as trustworthy by default.
- Instrument third-party access as an identity signal Track vendor account usage, request patterns, and transaction changes together so routine-looking supplier contact cannot silently become a breach path.
- Reduce exposure windows with faster containment playbooks Define escalation paths that isolate inboxes, revoke suspicious sessions, and validate vendor requests before the attacker can extend the compromise into finance or admin workflows.
Bottom line: Phishing remains a primary breach entry path because AI now lets attackers personalise at scale and move faster than traditional content filters can respond.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:38 pm
Behaviour, not message content, is now the decisive control plane for phishing defense: AI has made lure creation cheap, fast, and highly personalised, which means the old assumption that malicious email will look malformed or generic no longer holds. Defenders who still rely on static filtering are optimising for the wrong layer of the problem. The practical implication is that email defence must be evaluated by its ability to spot abnormal intent and follow-on behaviour, not just suspicious wording.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should security teams reduce the cost of phishing-related breaches?
A: By shortening the time between initial contact, investigation, and containment. The article shows that cost rises sharply as breaches linger, so teams should prioritise fast isolation of suspicious accounts, stronger vendor verification, and detection methods that can correlate email activity with identity and transaction changes.
👉 Read our full editorial: AI-powered phishing is still driving the costliest breaches