What’s in the 2026 report

This report looks back at 2025, examining how email-based threats have evolved throughout the year across organizations of all sizes. Our analysis highlights several trends that security practitioners should be aware of to maintain effective defenses. Sections include:

1. Continued evolution of BEC and social engineering
2. Threat uniqueness and customization
3. Evasion techniques by attack type
4. Evasion stacking
5. Getting hot: Opportunistic LOTS, ICS phishing, email bombs
6. Recommendations for 2026