Social Engineering Statistics

Vishing intrusions increased by 2x in 1H 2026.

39% of phishing messages featured novel social engineering techniques.

37% of phishing messages contained a high volume of text, up from 32% in the first half of 2025.

40% of organizations say employees did not suspect the attack because it appeared authentic.

34% of ransomware incidents begin with phishing emails or other email-based social engineering.

40% of organizations report that employees trust AI-powered attacks.

Almost a quarter of CISOs identify improving resilience against AI-enabled social engineering attacks as a key focus for the next 12 months.

More than four in ten CISOs are concerned about AI increasing the speed and impact of social engineering attacks.

80% of restaurants experienced a social engineering attack in the past year.

36% of restaurants experienced fraudulent refund requests as a form of social engineering in the past year.

36% of restaurants experienced phishing targeting staff credentials as a form of social engineering in the past year.

59.2% of IT and security professionals confirm experiencing AI-driven social engineering attacks in the past 12 months.

72% of Chief Information Security Officers report a significant increase in attacks, led primarily by AI-powered social engineering.

Human error (employees tricked into providing credentials) was cited in nearly 43% of identity incidents.

60% of digital trust professionals cited social engineering as an AI risk.

Internal team impersonation was present in 30% of phishing attacks by threat actors in Q1 2026.

In the last six months, calendar invite phishing increased by 49%.

Social engineering drove 88% of material losses in the first half of 2025 in Resilience's healthcare portfolio, making human error the industry's single most consequential vulnerability.

48% of enterprises' cyberattacks involve phishing or social engineering.

Novel social engineering phishing techniques increased from 32% to 38% year-over-year.

86% of CISOs fear agentic AI will increase the sophistication of social engineering attacks.

37.9% of small to mid-size organizations agree with the statement “We have observed a significant increase in sophisticated, AI-driven social engineering attacks targeting our employees in the past 12 months.”

8.5% of small to mid-size organizations strongly disagree with the statement “We have observed a significant increase in sophisticated, AI-driven social engineering attacks targeting our employees in the past 12 months.”

28% of SMB respondents say AI is creating hyper-personalized social engineering attacks.

24.1% of small to mid-size organizations strongly agree with the statement “We have observed a significant increase in sophisticated, AI-driven social engineering attacks targeting our employees in the past 12 months.”

58% of internal audit leaders identify automated social engineering as a leading AI-enabled fraud threat.

77% of organizations have been targeted by deepfake attacks.

51% of organizations have faced sophisticated, personalized phishing emails powered by deepfake technology.

In Q4 2025, callback phishing increased from 3% to 18% of all phishing incidents, a 500% spike.

In 2025, 'ClickFix' social engineering techniques were used in 1% of phishing attacks.

63% of retailers plan to invest significantly in generative AI for social engineering attacks.

65% of organizations expressed serious concern about IT help desk bypass and social engineering attacks as a top threat.

Nearly a third of leaders at financial services firms admit they are not fully confident employees could recognize an AI-driven phishing or social engineering threat.

64% of surveyed enterprises confirmed social engineering attacks via encrypted or informal channels in the past 12 months.

38% of organizations admit to being underprepared for AI-driven social engineering threats such as automated attacks, deepfake-based videos, and voice scams.

AI-enhanced phishing and social engineering are the most concerning tactics (27%) for insider threats.

78% of security leaders identify social engineering and phishing as their top threat.

Fake CAPTCHA social engineering attacks, particularly ClickFix campaigns, jumped 1,450% from the second half of 2024 to the first half of 2025.

Social engineering attacks accounted for 39% of initial access incidents observed during the first half of 2025.

44.7% of respondents cited phishing/social engineering as a top concerning threat.