Phishing has rapidly evolved into one of the most significant cyber threats across Europe. According to recent data, the volume of phishing attacks targeting organisations in Europe increased by 112.4% between April 2023 and April 2024, underscoring the growing sophistication and prevalence of phishing attempts that exploit vulnerabilities in both personal and corporate digital practices.

Why Phishing Demands Your Attention

In this blog, we’ll cover:

• The latest phishing statistics in Europe
• Why this issue is critical for businesses and individuals
• Practical, actionable tips to defend against phishing attacks

Headlines

• Phishing Defence Trends: Short-Term Gains, Long-Term Challenges, and Emerging AI Threats
• Emerging AI Threats
• What Drives the Phishing Surge?
• Protecting Your Enterprise from Cyber Threats
• Practical Steps to Combat Phishing Threats

Phishing Defence Trends: Short-Term Gains, Long-Term Challenges, and Emerging AI Threats

Recent trends in phishing defence performance reveal some mixed results for organisations. On a baseline level, organisations are seeing a 3.2% decline in their ability to defend against phishing, which suggests challenges in maintaining a high level of vigilance over time.

While 90-day performance saw a slight uptick of 0.6%, one-year performance dropped by 1.5%, indicating that short-term gains often don’t translate into long-term success. This gap in sustained defence highlights the difficulty organisations face in keeping up with evolving phishing tactics and reinforces the need for continuous adaptation in their cybersecurity strategies.

Interestingly, European organisations are faring better on average compared to the global trend. This can be partially attributed to the region’s more stringent cybersecurity regulations and heightened awareness of digital threats. However, even in Europe, organisations struggle to maintain long-term engagement in phishing defence. Many businesses see early improvements but fail to sustain those efforts over time, leading to a decline in performance. This pattern suggests that while organisations may initially implement effective measures, they often lack the resources or focus to continue strengthening their defences as threats become more sophisticated.

The growing concern of misinformation and disinformation as cybersecurity threats is also particularly relevant in the current landscape. ENISA has recognised these threats, as they can undermine an organisation’s ability to properly assess and respond to phishing or other cyber risks. As disinformation campaigns become more advanced, organisations are not only combating malicious emails but also trying to navigate the broader impact of false narratives that can weaken trust and hinder decision-making.

Emerging AI Threats

As phishing threats become more AI-powered and sophisticated, even organisations in Europe are not immune. These tools are making phishing attacks more personalised and harder to detect, amplifying the challenges faced by businesses in all regions. Smaller organisations, in particular, are at a disadvantage.

In Europe, small to mid-sized enterprises represent the majority of businesses, with most employing fewer than 50 people. These businesses are often ill-equipped to handle advanced cyber threats, making them prime targets for phishing attacks. With many small to mid-sized enterprises looking to adopt generative AI tools to boost productivity, they must balance innovation with the need for robust cybersecurity practices to avoid increasing their vulnerability.

What Drives the Phishing Surge?

Several factors contribute to the rise of phishing in Europe. The increased digitalisation of services, accelerated by the COVID-19 pandemic, has expanded the attack surface for cybercriminals. More employees are working remotely, often accessing corporate systems from less secure home networks. At the same time, the sheer volume of digital communication—emails, messaging apps, and collaboration tools—offers fertile ground for phishing attempts.

Cybercriminals are also becoming more collaborative. Underground forums and dark web marketplaces enable attackers to share tools, tactics, and even pre-built phishing kits, lowering the barrier to entry for new hackers. This democratisation of cybercrime has led to a proliferation of attacks across various sectors and scales.

Phishing remains one of the most profitable ventures for cybercriminals due to its high return on investment and relatively low overhead. Unlike other forms of cybercrime that may require significant technical expertise or resources, phishing attacks can be executed with minimal costs using widely available tools and templates which are custom made, purchased on the dark web or hosted openly on Github. Furthermore, the scalability of phishing campaigns allows attackers to target thousands of individuals or businesses at once, significantly increasing the likelihood of a payout.

The profitability is further amplified by the growing use of ransomware as a follow-up to phishing attacks , where attackers demand hefty sums to unlock systems or data they’ve compromised. This combination of low costs, broad reach, and high potential rewards makes phishing an enduring and attractive strategy for cybercriminals worldwide.

Protecting Your Enterprise from Cyber Threats

If you own or manage a small or medium-sized business, phishing is not just a corporate problem—it’s your problem too. Small businesses are frequently targeted because they often lack the robust cybersecurity infrastructure of larger corporations, making them prime targets for cybercriminals. Phishing attacks can result in stolen customer data, financial losses, or even operational shutdowns, consequences that can be devastating for businesses with limited resources.

Practical Steps to Combat Phishing Threats

Phishing attacks are becoming more sophisticated, and organisations are increasingly at risk. Fortunately, there are practical steps you can take to reduce your exposure and protect your operations.

Start by educating your team about the tactics cybercriminals use. Awareness is your first line of defence, and regular training can help employees recognise suspicious emails and avoid falling victim to scams. Enhancing your email security is also critical; advanced filtering tools can significantly reduce the chances of phishing attempts reaching your team.

A multi-layered approach to cybersecurity is essential. Relying on a single solution often isn’t enough, so combining email protection with endpoint security, firewalls, and other measures can provide more comprehensive coverage. Finally, being prepared for the possibility of an attack is crucial. Developing a response plan ensures your team knows how to act quickly and effectively, minimising damage and downtime.

Businesses can no longer afford to overlook the threat of phishing. With attacks growing more sophisticated, every employee is a potential target. Now is the time to take action—invest in evaluating the security awareness and preparedness of your organisation through simulated phishing attacks and comprehensive training to ensure your team can spot and resist these threats.

Strengthen your organisation’s first line of defence and protect your valuable data, reputation, and bottom line.

Don’t wait until it’s too late—arm your workforce with the knowledge and tools they need to stay one step ahead of cybercriminals by getting in touch today 👇