AI-Generated Phishing Is Now the Top Enterprise Email Threat, and IBM Data Shows Why It’s So Costly

Why the Cost Figure Keeps Getting Cited

Few numbers in enterprise security research have had as much staying power as IBM’s finding that phishing-related breaches average $4.88 million per incident. The figure comes from IBM’s Cost of a Data Breach research and continues to be the reference point cited across 2026 industry analysis of AI-driven phishing, according to a security industry write-up on AI-generated phishing as an enterprise threat. That durability matters: it suggests phishing costs have not meaningfully declined even as awareness of the threat has grown, because the attack itself has gotten more effective at roughly the same pace defenses have improved.

Phishing sits alongside business email compromise (BEC) as one of the costliest breach categories tracked in enterprise security research. The same analysis notes that 64% of US companies faced a BEC scam in 2024, with average losses around $150,000 per incident — and that ransomware, which is frequently a follow-on attack after a successful phishing compromise, is linked to phishing as its entry point 54% of the time. Phishing is rarely just its own line-item cost; it is frequently the opening move in a longer, more expensive attack chain.

Why AI Has Made Phishing Both Cheaper and More Effective

What has changed by 2026 is not that phishing works — it always has — but that AI has collapsed the cost of running a convincing campaign while barely denting its success rate. Harvard research cited in the same industry analysis found that 60% of recipients still fall for AI-generated phishing emails, a rate comparable to traditional, hand-crafted lures, meaning polished AI-written language has not made people meaningfully more suspicious. At the same time, attackers using large language models report saving roughly 95% on campaign production costs, since generating convincing, personalized lures no longer requires skilled human copywriting at scale.

That combination — comparable success rates at a fraction of the cost — is what security researchers point to as the reason AI-generated phishing volumes have grown so sharply. A Cobalt.io survey cited in the same analysis found 97% of cybersecurity professionals fear their organization will face an AI-driven security incident, and 93% expect to see daily AI-powered attacks within the coming year. The FBI’s own 2024 advisory flagged the same dynamic at the federal level, warning that AI increases the speed, scale and automation of phishing schemes by helping attackers craft “highly convincing messages tailored to specific recipients”.

Training and Speed, Not Just Technology, Separate Costly Breaches From Contained Ones

The most actionable finding in IBM’s own Ponemon-based research, per the same industry summary, is that the single biggest factor separating an expensive breach from a contained one is employee training combined with incident response speed — not any single piece of security technology. That reframes the phishing problem: the defense that scales against an AI attacker producing infinite personalized lures is not a filter that catches every message, but an organization that catches and contains the ones that get through quickly, and a workforce trained enough not to act on the ones that land in an inbox.

What This Means for Algerian Organizations

Algerian banks, telecoms and larger enterprises are exposed to the same AI-phishing economics as anywhere else, and the $4.88 million average breach cost — while a US-weighted figure — is a useful anchor for justifying security investment even at Algeria’s different cost scale.

1. Use the cost figure to justify DMARC and email-authentication investment now

Email authentication standards (DMARC, SPF, DKIM) are a comparatively low-cost technical control against domain-spoofing phishing, and IBM’s cost data gives Algerian CISOs and IT budget owners a concrete number to justify prioritizing full DMARC enforcement — not just monitoring mode — ahead of other, more expensive security investments.

2. Training and response speed, not just filtering, deserve the next security budget line

Because IBM’s own research points to training and response speed as the biggest differentiator between costly and contained breaches, Algerian organizations should treat phishing-simulation training and incident-response drills as core security spend, not an afterthought bolted onto a technology purchase.

3. Assume AI-generated phishing in Arabic and French is coming, if it hasn’t already arrived

The 95% cost reduction attackers gain from using large language models applies to any language a model can generate convincingly, including French and Algerian-dialect-adjacent Arabic phishing content. Algerian security teams should not assume language remains a natural barrier against AI-generated lures the way it may have against earlier, less fluent scam templates.

Frequently Asked Questions

Sources & Further Reading

• AI-Generated Phishing: The Enterprise Threat No One Can Ignore — StrongestLayer