Annual State of Phishing

Phishing Campaigns Continue to Evolve and Innovate

If we learned anything from 2020, it’s that threat actors’ ability to quickly adjust their methods to world events can be lightning fast. From Emotet to Ryuk, and let’s not forget COVID-19, threat actors improved their methods and adapted to world events, bringing new trends to the phishing threat landscape in 2021.

Download the 2021 Annual State of Phishing Report to learn how you can avoid a breach from the phishing threats that are targeting businesses around the globe.

All secure email gateways let phishing threats slip by.  Rapid detection and response to threats has never mattered more.

While your Secure Email Gateway (SEG) serves its purpose to remove known threats from your users’ inbox, none are 100% secure. When malicious emails reach the inbox, the chance of at least one click remains high. What are you doing to protect your business from a breach?

The 2021 Annual State of Phishing Report dives into the phishing threats we’ve seen reported by our 25M human reporters around the globe. It’s this first-hand customer reporting data that allows us to accurately detect, respond and provide intelligence on phishing threats that are out there.

Well-conditioned users report real phish quickly!

Average time it takes a user to report a suspected phishing email

2021 Annual State of Phishing Report

Phishing threats seen in the wild:


This ransomware threat is designed to appear as an internal business communication and is sent to victims within an organization, often with relevant employee names or positions. Once the embedded malicious link is clicked, threat actors have access to their target system.


This botnet focuses on obtaining, stealing, and exfiltrating different types of data, including local and stored credentials, contact lists, and emails.


Pandemic-themed campaigns picked up steam and peaked in April 2020, as much of the world adjusted to the concept of a “new normal.” Threat actors were quick to pounce by leveraging COVID-19 and remote work themes.

Phishing Predictions for 2021:

The SOC to have a more active voice in enterprise email configuration.

Configuring a secure mail gateway properly can be challenging. Security operations suffers on the downstream of a loose configuration.

MFA – Phishing campaigns and tooling will be more aware of multi-factor-authentication.

2020 fast tracked companies plans to move to an online platform like m365 or G-Suite, making the enablement of MFA more prolific. Attackers will adapt.

Techniques to evade Automated URL analysis will improve.

There will be fewer attachment-based phishing campaigns as attackers focus more on credentials. Attackers are already experimenting with CAPTCHA protected phishing sites.

Smishing will continue to be a big-nothing-burger.

The number of vendors that will sell a computer based training series about the dangers of Smishing will increase. But do you know what will not increase? The cases of actual smishing in the real world.

Download the 2021 Annual State of
Phishing Report

Check out the report for more insight into the phishing threats that are targeting businesses like yours, and what you can do about it.