Two surveys three years apart found security teams handling each phishing email faster while spending a larger share of their working hours on the problem.

 

What happened

Security teams resolved individual phishing incidents faster in 2026 than in 2022, while the total burden rose, according to research conducted by Osterman Research and announced in June 2026. Time spent on a single phishing email fell from 27.5 minutes to 23.2, and cost per message dropped from $31.32 to $27.51. Over the same period, the share of security team hours consumed by phishing rose from 33.5% to 36.5%, and annual salary spent per professional on phishing work climbed 13.6% to $51,948. The 2022 baseline surveyed 252 practitioners, and the 2026 follow-up surveyed 128 at organizations with 1,000 to 5,000 employees, so the comparison spans different sample sizes and scopes.

 

Going deeper

Every indicator staff was trained to check in 2022 was a property of the message itself, meaning something wrong in the header, the writing, the attachment, or the link, and finding it was the whole job. The indicators that matter now sit in the context around the message. A sender can be a real employee at a real vendor whose mailbox was taken over. Authentication can pass in full because the attacker registered the domain and published their own records, which leaves domain age as the only signal they did not control. Writing quality no longer separates anything, since fluent prose assembled from public sources costs nothing to produce.

 

What was said

Respondents named compromised internal accounts as the threat type concerning them most at 58.6%, with obfuscation including links weaponized after delivery and AI-personalized attacks tied at 57.8%, and multi-stage attacks crossing channels at 56.3%. The researchers noted that the 2022 report does not mention artificial intelligence at any point, while the 2026 edition addresses it throughout, which is the clearest measure of how much changed between the two surveys.

 

In the know

Attacks appearing in collaboration platforms such as Microsoft Teams and Slack were reported by 65.4% of respondents, against roughly 40% in 2022. Microsoft's own telemetry shows why that channel matters, since Teams traffic typically bypasses secure email gateways and a chat message appearing to come from a colleague carries a legitimacy an unexpected email does not. On synthetic media, 62.5% of respondents expected voice and video fakes to increase the time their teams spend on phishing, and 31.3% rated the impact extreme, the highest score recorded for any trend in the survey.

 

The big picture

Research published in PNAS Nexus testing 182 adults across laboratory and real-world tasks found older age predicted greater susceptibility, with cognitive factors rather than inexperience driving much of the risk, which matters for a sector employing large numbers of staff across every age band. NIST states the objective of phishing-resistant authentication plainly, writing that verifier impersonation resistance exists so as not to depend on the claimant detecting a phishing attack. Healthcare organizations weighing where to spend should note that credential theft accounted for 94% to 96% of malicious payloads in Microsoft's second-quarter data, which places the value on controls that hold after someone clicks rather than on training them not to.

 

FAQs

Why would faster handling produce a higher total cost?

Cost per incident and total cost move independently. If the number of messages requiring triage increases faster than efficiency improves, the total climbs even as each case resolves more quickly. The per-incident figure is the one that appears on a dashboard, which is why the trend can look positive while the budget line grows.

 

How should commissioned research be weighed?

Sponsored studies are common and often methodologically sound, though the sponsor selects the questions and the framing, which shapes what gets measured. Comparing the findings against independent sources covering the same ground is the practical check, and differences in sample size between survey waves warrant caution about year-over-year percentages.

 

What is post-delivery weaponization?

A link that resolves to harmless content when the security gateway inspects it at delivery, then redirects to a malicious destination once the recipient clicks hours or days later. Scanning at the point of delivery cannot catch it, which is why some organizations rewrite links to check the destination at click time instead.

 

Why do collaboration platforms need separate protection?

Email security tools inspect messages travelling over mail protocols, while chat and voice traffic moves through the platform's own infrastructure. Coverage requires tooling built for that platform, and organizations frequently discover the gap only after an incident that arrived through a channel nobody was monitoring.

 

What does domain age indicate?

The date a domain was registered is one of the few signals an attacker cannot fabricate, since a domain created last week cannot be made to look decades old. A message from a domain registered days earlier, particularly one closely resembling a known vendor, warrants scrutiny regardless of whether its authentication records pass.