MARKET RESEARCH

The (Higher) Business Cost of Phishing

Three years ago, Osterman Research put a price on phishing. Then ChatGPT launched.

Based on survey data from 128 IT and security professionals at mid-to-large organizations, this report tracks how the phishing burden has changed since 2022, what AI has done to both sides of the fight, and what it will cost you if defenses don't keep pace.

Key Findings:

  • Phishing Now Costs $51,948 Per Analyst
    That's a 13.6% jump since 2022. The full breakdown by role is in the report.
  • The AI Paradox Hit Defenders Hard
    Per-incident handling got faster. Aggregate hours got worse. The report explains why.
  • Phishing Concern Has Climbed (even further)
    Half of organizations now rate phishing as a high or extreme threat. In 2022, it was one third.
  • Deepfakes Have Moved from Theoretical to Disruptive
    62.5% of organizations expect deepfakes to significantly increase phishing response time.
Read White Paper
Osterman (higher) Business Cost of Phishing 2026

A Unified Approach
to Email Security

Protect your employees' inboxes from advanced phishing attacks that others miss, with the only technology that combines AI and human insights. Our platform is quick to deploy and dead simple to manage (so you get instant protection).

Protect Better
Block advanced phishing and BEC attacks (and never seen before threats) with our Adaptive AI—dynamically sharpened by real-world user insights and a community of over 36,000 threat hunters.

99.7%

Threats

Automatically Remediated by AI

35,000+

Analysts

Collectively Threat Hunting

protect_better
Simplify Operations
Slash the time your team spends remediating email incidents from 30 minutes per incident to 30 seconds. Our Adaptive AI scans every email for malicious indicators. When it finds a threat, it doesn’t just block it, it automatically finds and remediates all others like it in your environment.

“IRONSCALES has cut the number of man hours down by 95%.”

augustine_boateng_headshot_

Augustine Boateng

Interim Chief Information Officer, City of Memphis

simplify_operations
Empower your Org

Triple the email security awareness of your workforce and transform your employees into a crucial line of phishing defense. We make it dead simple to sharpen your employees' understanding of real-world threats with:

  • Phishing simulation testing
  • Security awareness training (SAT)
  • Dynamic email banners

...and a GPT-powered chat assistant

3X

Awareness

With integrated simulation and training

90%

Reduction

In employees clicking malicious links and attachments

empower_your_org
Container-1

Frequently Asked Questions

Learn more about the 2026 Osterman Research findings.

What does The (Higher) Business Cost of Phishing report cover?

The report draws on survey data from 128 IT and security professionals at organizations with 1,000 to 5,000 employees. It measures how phishing costs have changed since 2022 and what generative AI has done to both sides of the fight. It benchmarks against Osterman's original 2022 study, published four weeks before ChatGPT launched.

How much does phishing now cost per security analyst per year?

Phishing now consumes $51,948 per security analyst each year in salary and benefits, a 13.6% increase from $45,726 in 2022. IT and security teams devote 36.5% of their available working hours to phishing, up from 33.5%. The full breakdown by role is in the report.

What is the AI Paradox in email security?

AI-powered defenses made security teams faster at handling each phishing email. AI-generated attacks grew so fast in volume, speed, and evasiveness that total phishing cost rose anyway. Organizations now remediate phishing 16% faster per incident and spend 9% more of their annual hours doing it.

Are deepfake attacks already disrupting security teams?

Yes. 62.5% of organizations expect deepfakes to significantly increase phishing response time. Deepfake voice and video carried the highest "extremely impactful" rating (31.3%) of the three emerging threat trends surveyed. Most organizations say they aren't ready to defend against AI-enabled voice and video deepfakes. Deepfakes have moved from theoretical to operationally disruptive.

Who conducted the research, and who funded it?

Osterman Research, an independent analyst firm, conducted the research and wrote the report, which Ironscales commissioned. Survey fieldwork ran from September 15 to October 21, 2025, across 128 US-based IT and security decision-makers at organizations with 1,000 to 5,000 employees.

Stop Email Attacks.

Dead In Their Tracks.

Get better protection, simplify your operations, and empower your organization against advanced threats today.

Get started See pricing