The attackers have AI. Most small companies have nobody whose job this is.
Phishing is no longer misspelled. Voice and video can be faked on a laptop. The numbers below come from the largest public studies of breaches and workplace fraud, with the source under each one — and the part of Cowkeeper that exists because of it.
Last reviewed October 2026. Every figure links to its report; nothing here is estimated by us.
What changed in the last two years
Three things moved at once: the message got better, the voice on the phone got fake, and the money still goes out the same door — a person who was asked nicely and in a hurry.
In early 2024 a finance employee at the engineering firm Arup joined a video call with what looked and sounded like the company's CFO and several colleagues. Every other participant was a deepfake. Fifteen transfers later, about US$25 million was gone.[6] Nothing was hacked. Someone was asked, by a familiar face, to do their job quickly and quietly.
This is why Cowkeeper teaches the callback rule in every phishing course and runs drills with lookalike senders, urgency and secrecy — the three pressures that worked here.
What it costs when nobody owns it
Fraud and breaches are not an IT line item. They are revenue, time and trust — and in small companies the losses land harder because there is no cushion.
Frauds at companies with fewer than 100 employees had a median loss of $141,000 — close to the overall median of $145,000, on a far smaller revenue base.[7] Organizations with a reporting hotline cut the median loss in half ($100,000 against $200,000) and found the fraud in 12 months instead of 24.[7]
Every Cowkeeper employee has a Report button, and a human replies to every report.
43% of cases were detected by a tip, more than half of them from employees. More than twice as many tips came from employees who had fraud-awareness training, and organizations that trained both staff and managers had a median loss of $84,000 against $150,000 for those that trained neither.[8]
Training everyone — including the managers who approve payments — is not a compliance box. It is the control that halves the loss.
Why one training video a year does nothing
People do learn to spot phishing. Then they forget. Measured click rates fall fast with regular practice and creep back up when practice stops, which is why Cowkeeper's phishing training is quarterly, short, and built on what your own team just saw.
KnowBe4 2025 benchmark: 67.7 million simulated phishing emails across 14.5 million users. The 90-day bar applies KnowBe4’s reported 40% drop to its baseline; the other two are as published. Vendor data — the peer-reviewed study in point 2 is why the practice has to continue.[9][10]
An AI-driven workplace needs AI-era controls
Your team is already pasting customer data into chatbots, and attackers are already generating ten thousand personalised emails before lunch. The answer isn't a ban. It's knowing what is allowed, verifying what matters, and never trusting a request because it sounds right.
- An AI usage policy every employee reads and signs in SecureStart, with a receipt.
- Cowkeeper AI answers from your approved knowledge only, cites the source, and says "I don't know" instead of inventing. It can draft a request; it cannot approve one.
- Your company's knowledge is never visible to another company and never used to train anything.
- Drills written by your security specialist with lookalike senders, urgency and secrecy, because polished grammar is no longer a tell.
- The callback rule for any payment or credential change, taught and practised, so a perfect deepfake still fails at the last step.
- MFA enforced and verified from your identity provider, so a stolen password is not a stolen account.
Each risk, and the part of Cowkeeper built for it
Nothing on the right is a promise. Each one is a control in the product that shows Verified only when a system or a named person confirmed it — and Unknown when it can't.
- SecureStart requires MFA for every person; Cowkeeper reads enrolment status from Google Workspace every six hours, so "MFA on" is evidence, not a tick box.
- Passwords, Passkeys & MFA is one of the four Security Essentials courses every hire takes.
AI-written, personalised, from a lookalike domain, asking for something reasonable — and clicked as often as an expert’s.[4]
- Every employee has a Report button; a human triages every report and the reporter hears back.
- Phishing drills are written by your Cowkeeper security specialist around your vendors and payment flows, approved by you, and followed by a 20-minute Phish & Learn.
- Quarterly refresher with ten fresh scenarios, assigned automatically.
Deepfaked voice and video make "I recognise them" worthless as a check. Ask Arup.[6]
- Any payment change or credential reset goes through a known number or an in-app request your IT Manager verifies — written into the policies people sign and practised in drills.
- Cowkeeper AI prepares the request and hands it to a human; it never approves.
Dormant accounts and forgotten app logins are the quiet half of insider risk.
- Suspend sign-in, revoke sessions, remove groups, revoke every app, and stop file sharing on the device — each step read back from the provider or the Cowkeeper Agent before it counts.
- Dormant-account review is a baseline control with evidence from the directory.
Unencrypted, unpatched, no protection agent — one lost bag is a breach.
- Verifies encryption, screen lock, firewall, updates and a protection agent on every company computer, and reports what it sees — never files, browsing or keystrokes.
- Company policy can block removable drives and AirDrop, with every person told why.
A pricing sheet shared to a personal Gmail is a leak nobody notices until it matters.
- Cowkeeper reads Google Drive's own audit log and shows every file shared to an outside address, a personal account, or anyone with the link; one click asks for it to be revoked and the log confirms when it is.
Most fraud is found by a tip, a median of 12 months in.[8]
- Every control is Verified, Pending or Unknown — from provider evidence, the agent, or a named Cowkeeper who attested, with the date. Quarterly reviews with your IT Manager go through the exceptions, not a slide deck.
Start with the numbers for your companySee your own risk picture in 30 days.
The IT Reset starts with a baseline assessment of the 21 controls above, against your real Google or Microsoft setup. You get the readiness report whether or not you continue.
Sources
Figures are quoted from the edition named; where a newer edition changes a number we update this page. If you spot an error, tell us and we will fix it.
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report (PDF): 1,008,597 complaints; $20.877 billion in losses, a 26% increase from 2024; business email compromise 24,768 complaints and $3,046,598,558 in losses.
- IBM and Ponemon Institute, Cost of a Data Breach Report 2026, press release 29 July 2026: 602 organizations, breaches March 2025–February 2026; global average $4.99 million; one in four malicious breaches AI-enabled, averaging $6 million, a 56% increase over the prior year.
- Microsoft, Digital Defense Report 2025, Microsoft On the Issues, 16 October 2025: "more than 97% of identity attacks are password attacks"; "phishing-resistant multifactor authentication (MFA) can stop over 99% of this type of attack".
- Fred Heiding, Simon Lermen, Andrew Kao, Bruce Schneier and Arun Vishwanath, Evaluating Large Language Models' Capability to Launch Fully Automated Spear Phishing Campaigns: Validated on Human Subjects, arXiv:2412.00586, 30 November 2024: 101 participants; click-through 12% control, 54% human experts, 54% fully AI-automated, 56% AI with a human in the loop.
- CrowdStrike, 2025 Global Threat Report findings, 27 February 2025: "Voice phishing (vishing) attacks skyrocketed 442% between H1 and H2" 2024; 79% of detections malware-free.
- Kathleen Magramo, CNN, Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee, 16 May 2024: HK$200 million (about US$25.6 million) across 15 transactions; Arup: "we can confirm that fake voices and images were used".
- Association of Certified Fraud Examiners, Occupational Fraud 2024: A Report to the Nations (PDF): 1,921 cases from 138 countries; "CFEs estimate that organizations lose 5% of revenue to fraud each year"; median loss $145,000; companies with fewer than 100 employees median loss $141,000; with a hotline median loss $100,000 and 12 months to detection, without one $200,000 and 24 months.
- Association of Certified Fraud Examiners, Occupational Fraud 2026: A Report to the Nations — key findings, May 2026: 2,402 cases from 143 countries; median loss $104,000; median scheme duration 12 months; tips detected 43% of cases, more than half from employees; organizations that trained staff and management had a median loss of $84,000 against $150,000 for those that trained neither.
- KnowBe4, Phishing by Industry Benchmarking Report 2025, press release 13 May 2025: 67.7 million simulations, 14.5 million users, 62.4 thousand organizations; baseline Phish-prone Percentage 33.1%, falling by 40% in three months and to 4.1% after 12 months; 24.6% baseline for organizations with 1–250 employees. Vendor data.
- Benjamin Reinheimer, Lukas Aldag, Peter Mayer, Mattia Mossano, Reyhan Duezguen, Bettina Lofthouse, Tatiana von Landesberger and Melanie Volkamer, An investigation of phishing awareness and education over time: When and how to best remind users, USENIX SOUPS 2020: 409 employees; improvement held at four months and "was not the case anymore after six months"; video and interactive reminders lasted "for at least another six months".
- Proofpoint, Phish tests reveal human-targeted threats are evolving, 8 April 2025: more than 212 million simulated messages in 2024; average failure rate 4.93%; average reporting rate 18.65%.
- Verizon, 2026 Data Breach Investigations Report, press release 19 May 2026: frequent use of AI tools by employees rose from 15% to 45% in a single year; shadow AI is the third most common non-malicious data-leakage activity; 48% of breaches involved a third party; mobile social engineering succeeds 40% more often than email phishing.
- IBM and Ponemon Institute, Cost of a Data Breach Report 2025, press release 30 July 2025: 600 organizations; one in five reported a breach due to shadow AI, with $670,000 in higher average costs; 16% of breaches involved attackers using AI tools, mostly for phishing or deepfake impersonation; 63% of breached organizations had no AI governance policy or were still developing one.
- Verizon, 2025 Data Breach Investigations Report, press release 23 April 2025: over 22,000 incidents and 12,195 confirmed breaches; credential abuse the leading initial access vector at 22%; third-party involvement doubled to 30%; ransomware present in 44% of breaches, median payment US$115,000.