AegisAI Perspectives · 007
About 16% of data breaches start with a phishing email or other phishing message, per Verizon's 2026 DBIR. Every figure here is dated and linked.
About 16% of data breaches start with a phishing email or another phishing message: that is phishing's initial access share in Verizon's 2026 Data Breach Investigations Report (DBIR)8. Larger figures answer different questions. This page lists the email threat statistics for 2026 with a date and a link for each, and says what each number measures.
They measure different things. Three definitions cover most of the published figures.
Initial access. This counts the first action that got an attacker in. In DBIR 2026, vulnerability exploitation leads at 31%, phishing follows at 16%, then credential abuse at 13% and pretexting at 6%. Verizon says software flaws passed stolen credentials as the top entry point for the first time in 19 years4. One year earlier, DBIR 2025 put credential abuse at 22%, exploited device vulnerabilities at 20% and phishing at 16%11.
The four tracked vectors in DBIR 2026 add up to only 66% of initial access9. The other third has no named vector in that figure, so the phishing share of 16% is a floor, not a full count.
Involvement. This counts breaches where phishing appeared at any stage. StationX puts phishing in 36% of all data breaches and attributes that to DBIR 202517. The same page gives 16% as the initial vector, attributed to IBM 2025, and does not explain the gap18.
Human element. This is wider still. In DBIR 2025, 60% of breaches involved the human element12. That covers a person clicking, being tricked or making an error, so it includes much more than email.
Third party. Verizon's 2026 release says breaches involving a third party account for 48% of all breaches6. That counts who was involved, not how the attacker got in.
Unsourced claims. Some pages print figures with no dataset behind them. Astra projects phishing at more than 42% of global breaches in 2026 and names no source19. PhishSkill says more than 90% of cyberattacks begin with a phishing email and also names no source21. Astra gives over 90% and attributes it to CISA20. Find the CISA document that states it before you repeat it.
DBIR 2026 covers incidents from November 1, 2024, to October 31, 20257. Phishing is also leaving the inbox: 41% of social engineering breaches now involve vectors other than email10.
They come from a different count. The FBI's Internet Crime Complaint Center (IC3) counts complaints and reported losses, not confirmed breaches. So an IC3 total cannot be divided by a DBIR share.
IC3 received 191,561 phishing and spoofing complaints in 2025, the largest crime type by complaint count1. IC3 defines that category as unsolicited email, text and phone requests, so it is not email alone.
Business email compromise (BEC) drew 24,768 complaints and $3,046,598,558 in reported losses in 2025, second only to investment fraud by loss2. Stingrai reports that wire transfer or ACH made up 86% of the payment methods named in those BEC complaints16. For the controls that stop that payment step, see how to prevent business email compromise.
Ransomware looks smaller in IC3 data: more than 3,600 complaints and losses above $32 million in 20253. IC3 complaint counts do not say how each ransomware incident started.
DBIR shows how often phishing opens a breach. IC3 shows how much money email fraud moves once it works.
The AegisAI Q3 2026 State of the AI Attack report measures mailboxes, not breaches. Its sample is more than 100 million emails sent to over 1 million protected mailboxes between July 1 and September 2, 2026, with every phishing verdict confirmed by its threat research team24.
In that sample, confirmed phishing rose 49% relative to overall email volume22. AI Dragnet attacks sent from hijacked accounts rose 38 times, from 0.2% to 7.7%. A hijacked account sends from a real mailbox, so sender reputation checks have little to flag. For how those mass campaigns work, read what AI Dragnet phishing is and why it is harder to detect.
Read this as a rate of attempts that reached a protected mailbox. It is not a breach survey, so it does not change the DBIR initial access figure.
Write "initial access", "involvement" or "human element" next to it. The DBIR 2026 phishing share of 16% is initial access; the 36% StationX figure is involvement.
Trace a roundup figure back to the report it cites. StationX attributes 36% to DBIR 2025, while DBIR 2026 has since been published.
DBIR 2026 data ends on October 31, 2025. Label it as such in board slides, not as "2026 activity".
IC3 counts complaints; DBIR counts breaches; mailbox reports count messages. Do not mix units in one sentence or chart.
The four DBIR 2026 vectors total 66% of initial access, so each share is a share of all breaches, with a third unassigned.
The 42% projection and the 90% claim name no source. Leave them out of reports.
Several DBIR figures here come from summaries of the report. Cite the summary, and replace it with the DBIR page reference once you have read it.
| Attack type or measure | Figure | Source and date | What it says | What it does not say |
|---|---|---|---|---|
| Vulnerability exploitation, initial access | 31% | Verizon DBIR 2026, May 2026 | First entry step in 31% of breaches | Which flaws, or how fast they were patched |
| Phishing, initial access | 16% | Verizon DBIR 2026, May 2026 | Phishing was the first step in 16% of breaches | That every one was an email |
| Credential abuse, initial access | 13% | Verizon DBIR 2026, May 2026 | Stolen or misused logins opened 13% | How the credentials were stolen |
| Pretexting, initial access | 6% | Verizon DBIR 2026, May 2026 | A fabricated story opened 6% | The channel the story arrived on |
| Phishing anywhere in a breach | 36% | StationX citing DBIR 2025, Oct 2026 | Phishing appeared at some stage | That phishing started the breach |
| Human element | 60% | Beyond Identity citing DBIR 2025, Apr 2025 | A person was involved in 60% of breaches | That email was the channel |
| Phishing and spoofing complaints | 191,561 | FBI IC3 2025 report | Largest crime type by complaint count | How many became breaches |
| Business email compromise losses | $3,046,598,558 | FBI IC3 2025 report | Reported losses across 24,768 complaints | Losses that went unreported |
| Ransomware complaints | 3,611 | FBI IC3 2025 report | Complaints filed with IC3 in 2025 | How each ransomware attack started |
| Confirmed phishing, first party sample | 49% rise | Q3 2026 State of the AI Attack, Oct 2026 | Rise relative to overall email volume in the Q3 sample | Anything about breaches |
Illustrative example, figures are fictional. A security lead drafts a board slide that says "91% of breaches start with phishing". She runs the steps above. The figure comes from a vendor blog with no dataset, so she drops it. She replaces it with two lines: "Phishing was the first step in 16% of breaches (Verizon DBIR 2026, data to October 2025)" and "Business email compromise drew $3,046,598,558 in reported losses in 2025 (FBI IC3)". Her own incident log for the year shows 40 confirmed incidents, 9 of them opened by an email. She adds that 9 of 40 as the internal figure and labels its window.
Track three numbers from your own records, each labelled with its unit and window.
About 16%. Verizon's 2026 DBIR puts phishing at 16% of initial access, behind vulnerability exploitation at 31%. Some of that phishing is not email: 41% of social engineering breaches now involve other vectors. Higher figures measure involvement or the human element.
By complaint count, email-led fraud is the largest category: IC3 logged 191,561 phishing and spoofing complaints in 2025. For breach entry it is no longer first. DBIR 2026 puts exploitation at 31% and phishing at 16%. IC3 ransomware data does not say how each attack started.
No dataset in this review supports it. PhishSkill states it with no source. Astra attributes it to CISA. The figure does not match the DBIR 2026 initial access share of 16%. Find the primary document before quoting it.
Yes. The 2026 DBIR reports that 31% of breaches began with exploitation of software flaws. It is the first time in 19 years that this passed stolen credentials as the top entry point. Phishing stayed at 16% of initial access in both DBIR 2025 and 2026.
IC3 recorded $3,046,598,558 in reported BEC losses from 24,768 complaints in 2025, second only to investment fraud. Wire transfer or ACH made up 86% of the payment methods named in those complaints.
Yes. In DBIR 2026, 41% of social engineering breaches involve vectors other than email. Verizon also reports that mobile social engineering succeeds 40% more often than traditional email phishing.
