![](\"https:\/\/mms.businesswire.com\/media\/20260604282631\/en\/2650860\/5\/IRONSCALES-Logo-Dark-Blue.jpg\"){kind=logo}
<\/a><\/a>\nThe report, which surveyed 128 IT and security professionals at organizations with 1,000 to 5,000 employees, serves as a direct benchmark against the original \"Business Cost of Phishing\"<\/a> study published in October 2022, four weeks before ChatGPT launched. Together, the two studies provide the first before-and-after measurement of generative AI's impact on the phishing threat landscape.<\/p> \nKey findings include:<\/b><\/p> \n\"The timing of these two studies creates a natural experiment,\" said Michael Sampson, Principal Analyst at Osterman Research. \"Our 2022 report didn't mention artificial intelligence once. This one has AI on every page. Organizations remediate phishing incidents 16% faster but spend 9% more of their annual hours doing so. Security teams got more efficient at fighting phishing, but attackers got even more efficient at creating phishing attacks. So far, the threat actors have gained the upper hand.\"<\/p> \nAI accelerates both sides of the phishing equation<\/b><\/p> \nThe report identifies three dynamics that AI has amplified for attackers: volume, speed, and evasiveness. Personalized phishing attacks that previously required hours or days of manual research now take minutes to prepare. Shorter preparation time translates into faster campaign cadence. And attackers are using AI to probe defensive configurations and autonomously adapt campaign attributes to bypass detection.<\/p> \nFour out of ten respondents expect all three dynamics to worsen over the next 12 months. A minority expect improvement, resting on the assumption that their organizations can deploy AI-powered defenses at a faster pace than attackers can adopt AI for offense. The data suggests that the assumption remains an open question.<\/p> \nIndependent research released last month echoes the shift. Verizon's 2026 Data Breach Investigations Report<\/a> cites a doubling of AI-assisted text in malicious emails compared to prior years, with phishing now accounting for 44% of AI-assisted initial access attempts.<\/p> \n\"The economics of phishing have fundamentally changed,\" said Audian Paxson, Principal Technical Strategist at IRONSCALES. \"Before generative AI, personalizing a phishing attack required manual research, which limited it to high-value targets. Now, personalization is cheap and fast, so it can be applied across an entire organization. The defensive model that worked three years ago (detect, investigate, respond) is being overwhelmed by volume. Organizations need to get ahead of attacks, not just respond to them faster.\"<\/p> \nShifting from reactive defense to preemptive security<\/b><\/p> \nIRONSCALES has responded to the evolving threat landscape with agentic AI capabilities designed to anticipate attacks rather than just react to them. Launched in March 2026, the IRONSCALES platform now includes three agentic AI capabilities<\/a>: a Red Teaming Agent that researches organizations the way attackers do and hardens detection models before real attacks arrive; a Phishing SOC Agent that performs L2 analyst-level forensic investigation in minutes; and a Phishing Simulation Agent that generates training scenarios based on real reconnaissance against the organization's actual threat landscape.<\/p> \nThe IRONSCALES platform also includes Deepfake Protection for Microsoft Teams, the industry's first integrated solution that verifies participant identities in real time using visual and audio analysis, without recordings or transcripts.<\/p> \nReport availability<\/b><\/p> \n\"The (Higher) Business Cost of Phishing\" is available for download at https:\/\/ironscales.com\/the-higher-business-cost-of-phishing\/report-download<\/a>.<\/p> \nIRONSCALES and Osterman Research will present the full findings in a joint webinar, \"37% of Your Team's Time: The (Higher) Business Cost of Phishing,\" with registration details available at ironscales.com\/events<\/a>.<\/p> \nAbout IRONSCALES<\/b><\/p> \nIRONSCALES is the leader in AI-powered email security, protecting over 17,000 global organizations from advanced phishing threats. The IRONSCALES platform combines Adaptive AI, agentic automation, and crowdsourced human intelligence from 35,000+ security professionals to detect and remediate phishing, business email compromise (BEC), account takeover, and deepfake attacks that bypass Microsoft 365, Google Workspace, and legacy secure email gateways. Recognized by Gartner, Forrester, IDC, GigaOm, Frost & Sullivan, KuppingerCole, and G2 as a leader in email security, IRONSCALES is headquartered in Atlanta, Georgia. Visit ironscales.com to learn more.<\/p> \nAbout Osterman Research<\/b><\/p> \nOsterman Research provides analysis and insight into technology trends, market dynamics, and best practices in messaging, collaboration, security, and related technology areas. For more information, visit ostermanresearch.com<\/a>.<\/p>\n