Why can phishing cost per email fall while total security spend still rises?

Why the unit cost can fall even when the programme gets more expensive

A phishing cost per email metric usually compresses several different inputs into one weighted average. If teams resolve a larger share of incidents in cheaper, faster buckets, the average can improve even while analyst salaries, tooling, training, and total message volume keep pushing annual spend upward. The headline metric is telling you about mix and efficiency, not the entire cost base.

That distinction matters because phishing operations are not a single fixed workload. A quiet year with more automation, better triage, or more low-severity reports can lower average cost per email, but a larger attack surface, more user reports, or higher labour rates can still increase the total programme budget. The same pattern shows up in other security operations measures when people confuse marginal handling cost with fully loaded annual cost.

In practice, the best reading is to compare per-incident efficiency against total workload and total spend separately. That lets you tell whether the organisation is getting better at handling each message, merely seeing a different mix of cases, or actually reducing the cost burden across the whole phishing programme.

What drives the gap between average handling cost and total spend

The gap usually comes from three places: volume, labour mix, and control maturity. More inbound phishing messages can raise the total effort even if each individual case is cheaper to process. If the team shifts more events into automated or standardised handling, the weighted average falls because fewer hours are spent on each message, but the control stack can still cost more to run and maintain.

Labour is the other major driver. Analyst time, incident coordination, legal review, user support, and awareness follow-up often rise with wage inflation or broader scope, even when the unit cost per event declines. When phishing is managed as a programme rather than a one-off incident stream, the organisation pays for readiness, detection coverage, and response capacity, not just for the messages that get investigated.

That is why a falling average can be a sign of operational improvement without being a sign of cheaper security. It can mean the team is handling routine cases faster, but it does not cancel the fixed and semi-fixed costs that support the function across the year. Security Budget and Investment Planning Guide is useful when you need to separate unit economics from programme funding decisions.

How to read phishing economics without drawing the wrong conclusion

Use at least two views: cost per email and total annual programme cost. Then add a workload view such as message volume, report volume, and time-to-contain or time-to-resolve. If the average cost falls while volume and staffing climb, the likely story is improved handling efficiency, not a lower total burden.

For a defensible read, track what the average includes. Some teams count only direct analyst time, while others include tooling, managed services, training, and overhead. Those different scopes can make one year look cheaper even when the full programme got more expensive. A clean comparison needs a consistent cost model and a stable denominator.

If you want the operational mechanics behind the response side, the Phishing Incident Response Playbook is a useful reference for thinking about triage, containment, and remediation as separate cost buckets. For the control layer itself, the Phishing Guide helps explain why some campaigns are cheap to absorb while others force expensive investigation and cleanup.

Risk and Threat Considerations

The main risk is mistaking a better average for a safer or cheaper programme. A weighted cost metric can improve when teams resolve more routine phish quickly, yet the organisation may still be absorbing more attacks, more user reports, or more downstream cleanup. That creates false confidence in both budget control and operational resilience.

Failure mechanism: The denominator changes faster than the underlying workload, or the cost scope excludes major programme components such as tooling, escalation, or overhead. That makes the average look better even while the real operating burden grows.

Impact: Leaders may underfund phishing response, miss rising attack pressure, or draw the wrong conclusion about the effectiveness of their controls. Over time that can leave the team with improved unit handling but insufficient capacity for peak load or major incidents.

Practitioner Guidance

What to prioritise: Reconcile the metric definition before using it in budget or performance reviews. The first question is not whether the number moved, but whether the cost scope and workload mix stayed comparable.

Common mistake: Treating a lower per-email figure as proof that the programme can absorb cuts. In security operations, better throughput often increases the value of the function, because higher-speed handling makes it possible to manage more volume without collapsing response quality.

Practitioner takeaway: A falling average is useful only when it is read against workload, scope, and total spend, otherwise it can hide an expanding security operation behind a better-looking number.

Practitioner Guidance

What to verify: Check whether the cost metric is based on direct handling time only or on fully loaded programme cost. If it excludes tooling, overhead, and readiness work, do not use it to claim the programme got cheaper overall.

Decision rule: If average cost per email is falling but total workload is rising, treat that as an efficiency improvement, not a budget reduction. If both average cost and total cost fall on a consistent scope, then you can argue the programme is genuinely getting cheaper.

What to measure: Keep the average cost metric alongside annual spend, message volume, percent auto-resolved, and median time to close. That combination shows whether the lower unit cost came from process improvement, incident mix, or accounting scope.

Practitioner takeaway: Unit cost is a performance signal, while annual spend is a capacity signal, and you need both to judge whether phishing operations are truly becoming more efficient.

Related resources from NHI Mgmt Group

• Why does credential phishing still work in organisations with mature email security?
• How should security teams reduce email phishing risk when users still need access to business systems and data?
• Why does relying on email security alone still leave organisations exposed to phishing risk?
• Why do traditional email security tools still miss modern phishing campaigns?