Phishing Surpasses Ransomware as Leading Cyber Threat Globally in 2025

Phishing has emerged as the leading entry point for ransomware attacks, surpassing other vectors, with 35% of affected organizations citing it as the primary cause, up from 25% in 2024. This increase is driven by the rising sophistication of phishing-as-a-service (PhaaS) platforms and adversary-in-the-middle techniques, which enable cybercriminals to bypass multifactor authentication and hijack active sessions. AI-powered tools are further enhancing phishing capabilities, allowing attackers to create personalized lures and high-quality phishing pages rapidly. Despite the growing threat, many organizations remain underprepared, with only 47% employing AI in their security operations and limited automation in identity threat responses. Infostealer malware continues to evade traditional defenses, contributing significantly to identity-based threats, while repeat ransomware attacks are common, affecting 85% of organizations, with many experiencing multiple incidents annually. Additionally, operational challenges such as lack of protection, insufficient personnel, and ineffective cybersecurity products exacerbate vulnerabilities, with some victims resorting to ransom payments to recover encrypted data.