The phishing reality facing Australia

When it comes to software and app security, you’re only as strong as your weakest link and today more than ever, phishing is that link.

If your users (and administrators) can access critical and sensitive data, then it can also be reached by being phished.

There are best practice protocols to defend companies though if they’re not in place - or ignored - the risk exposure is real.

Research by Microsoft instructs that AI-written and delivered phishing emails are clicked 4.5x more than human-written phishing emails.

And by our analysis, when you multiply that by the number of Australians that would have been phished under ‘normal’ circumstances, almost 1.2m Australians are in the firing line.

It’s not good.

‍

Key findings

• Effectiveness uplift: AI-written phishing emails test at ~4.5x the click-through of standard attempts (Microsoft).
• Scale of exposure: Around 1.18 million Australians could be affected over the next 12 months, about +930k vs recent annual baselines.
• Company incidents: Large-org phishing breaches reported last year were 147. A 4.5x uplift projects to ~540 in 2025, affecting ~715,500 people via company incidents.
• Direct-to-individual scams: Recent average of ~103,228 people per year scammed via phishing rises to ~464,528 with a 4.5x uplift.
• Economics: Up to 50x higher profitability for phishing with AI, which increases attacker adoption.

‍

What is driving the change

• Language quality at scale, messages read like a colleague.
• Context injection, public data and recent activity make lures feel specific.
• Rapid micro-testing, thousands of variants, the winners scale.

‍

Scenario model, at a glance

• Company breaches stream: Baseline 147. Apply 4.5x effectiveness to approximate ~540 in 2025. Multiply by conservative average exposure per breach to reach ~715,500 people affected.
• Individual scams stream: Baseline ~103,228. Apply 4.5x to reach ~464,528.
• Combined order of magnitude: ~1.18m people. This is a scenario, not a point forecast.

‍

Sensitivities and caveats

• Effectiveness varies by sector, inbox controls, and attacker quality. 4.5x is a widely cited figure, real-world ranges will differ.
• Reporting lag means recent breach counts may revise upward.
• Defender improvements could blunt uplift. Even a partial uplift still produces a marked increase.

‍

Why it matters now

• Phishing already leads reported company breaches in Australia.
• AI tilts the threat from volume to quality, so legacy awareness and static filters decay quickly.
• The practical risk is the chain after the first click, not the email itself.

Bottom line: Treat ~1.18m as planning-grade scale, not prediction. The signal is clear... phishing is getting better at sounding like us.

‍

Update

Really pleased to see The Daily Mail use our research as part of a phishing story. The more that people know the risk, the better.