What Percentage of Breaches Start With Phishing? It Depends Who You Ask

Ask how many data breaches start with phishing and you will get answers ranging from 16% to 95% — all from organisations you have heard of, all quoted with a straight face. Those numbers cannot all be describing the same thing, and they are not. This piece is about what each number actually measures, why they contradict each other, and how to read cybersecurity statistics without being taken for a ride.

The numbers, as published

Here is a sample of widely-quoted phishing statistics, each from a real report by a large organisation:

• §16% of data breaches began with phishing, making it the most common initial attack vector — IBM's Cost of a Data Breach Report 2023 [1].
• §41% of incidents involved phishing as the initial infection vector — IBM's X-Force Threat Intelligence Index 2023, covering incidents IBM's own response team handled [2].
• §36% of breaches involved phishing — Verizon's 2021 Data Breach Investigations Report [3].
• §74% of breaches involved the human element (error, misuse, stolen credentials, or social engineering) — Verizon's 2023 DBIR; the 2024 edition put it at 68% after changing how it counts [4].
• §Eight to nine in ten cyberattacks — 80 to 95% — begin with phishing, according to Comcast Business, based on attacks against its own customers' networks [5].

Take those at face value and the arithmetic falls over immediately. If roughly three-quarters of breaches involve people, and phishing kicks off 80 to 95% of attacks, then well over half of all breaches should involve phishing. Yet Verizon says 36% and IBM says 16%. Something is wrong — and it is not that anyone is lying.

Different questions, different denominators

Each of these numbers is the answer to a different question. The trap is that they all get compressed into the same headline: "X% of breaches start with phishing."

• §IBM's 16% counts phishing as the confirmed first point of entry, in a study of breaches at organisations that took part in a cost survey. First door in, nothing else.
• §IBM's 41% comes from a different IBM team measuring a different population: incidents its X-Force responders were called in to fix. Same company, two reports, numbers 25 points apart.
• §Verizon's 36% counts any breach where phishing appeared at any stage, from a dataset contributed by dozens of partners with their own definitions.
• §Comcast's 80–95% is about cyberattacks observed hitting its customers — attempts, not confirmed data breaches. Most attacks fail, so 'attacks' will always dwarf 'breaches'.
• §The human-element figures include things that are not phishing at all: fat-fingered database exports, misconfigured cloud buckets, an employee misusing access.

Breach versus incident versus attack. Initial vector versus involved-at-any-stage. Self-reported survey versus a responder's case files versus a network operator's telemetry. Change any one of those and the percentage moves by tens of points, honestly and legitimately.

The numbers that deserve extra scepticism

Some figures circulate so widely that they have detached from their origins, and a couple of them deserve a harder look than they usually get.

The claim that phishing attacks have risen "4,151% since ChatGPT launched" comes from SlashNext, a company that sells anti-phishing software. Its earlier report put the figure at 1,265% [6]. The trend it describes — generative AI making phishing cheaper to mass-produce — is real and corroborated elsewhere. But a four-digit percentage from a vendor's own detection telemetry is marketing arithmetic as much as it is measurement, and it should be quoted with the vendor's name attached, not as a fact about the world.

Similarly, the striking statistic that spear-phishing makes up just 0.1% of email attacks yet is responsible for 66% of breaches comes from a single Barracuda Networks report [7]. The 0.1% is measurable from Barracuda's own email telemetry — it scanned billions of messages. But email filters cannot observe what share of the world's breaches an attack type causes, and the report, which mixes that telemetry with a commissioned survey of IT professionals, never shows how the 66% was derived. The underlying point stands — targeted phishing punches far above its weight — but the precision is an illusion.

One AI claim that does hold up reasonably well: IBM's X-Force social-engineering team found that generative AI could produce a convincing phishing email in about five minutes, versus roughly sixteen hours for their human team to build one by hand [8]. That was an experiment, clearly described, by people with no obvious incentive to exaggerate their own obsolescence.

What you can actually conclude

Strip away the numerical noise and a few findings survive, because they show up consistently across sources with different methods and different incentives:

• §Phishing is consistently at or near the top of the initial-access list, whoever is counting. The disagreement is about how far ahead it is, not whether it matters.
• §Most breaches involve a person doing something a criminal wanted them to do — clicking, approving, reusing a password. That holds at 68% or 74%; the exact figure is beside the point.
• §Targeted phishing is disproportionately effective compared with bulk spam, even if '0.1% causes 66%' is too tidy to be literal.
• §Generative AI has collapsed the cost of producing plausible phishing at scale. The 4,151% figure is vendor theatre, but the direction of travel is not in dispute.

“There is no single true percentage, and anyone who quotes one without telling you what was counted is either careless or selling something.”

Why this matters for a small business

Here is the practical upshot for an Australian small business: your defences should not change one bit whether the real number is 16% or 90%. Every credible measurement agrees that phishing is a leading way in, that people are the target, and that the cheap defences work — multi-factor authentication on email and accounting systems, a written rule to verify bank-detail changes by phone, and training that shows your team what real phishing looks like rather than lecturing them about statistics.

The percentage that actually matters is not in any vendor report. It is the percentage of your own team who would pause and check before acting on an urgent, plausible-looking request. That one you can measure, and that one you can move.