SpyCloud Report Finds Higher Phishing Volume and Token Exposure Challenges
4th article in the last 90 days, one of 8 articles referencing SpyCloud. Previous coverage: SpyCloud Releases 2026 Phishing Pulse Report on Enterprise Attacks (Jun 2026).
Companies mentioned
Best suited for
- Seniority
- C Level / Executive Team
- Job function
- Chief Information Security Officer
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Buyer journey
- Need to Buy
- Adoption curve
- Early Majority
- Technology maturity
- Operational Expansion
- Industry
- Information Technology / Software & Services / IT Services / Data Processing & Outsourced Services
Our classification, not the publisher's statement. Best suited for, not only for.
SpyCloud released its 2026 Phishing Pulse Report, which focused on survey results and analysis of active phishing campaigns and phishing-as-a-service infrastructure. The report matters to enterprise security teams because it outlines reported changes in phishing volume and the difficulties organizations face after a successful attack.
In a survey of security professionals at organizations with more than 1,000 employees, SpyCloud found that 78% reported an increase in phishing volume over the past 12 months. It also found that 84% said AI-generated phishing attacks are becoming more prevalent or harder to defend against. Separately, SpyCloud reported that employee data was exposed at 86% of Fortune 100 companies over the last 12 months.
SpyCloud’s analysis combined survey findings with observations of active phishing campaigns and phishing-as-a-service infrastructure. The report included that only 38% of organizations were very confident they could detect and respond to credential theft within 24 hours, and 58% struggled to identify which credentials or session tokens were exposed after a phishing incident. It also reported that only 30% had fully integrated phishing detection with identity response workflows.
SpyCloud researchers observed that approximately half of recaptured phishing-as-a-service platform-sourced records were tied to enterprise identities, versus 11% of malware-sourced records. The report also listed respondents’ concerns beyond AI-generated phishing, including business email compromise at 58% and vendor impersonation at 52%. “Phishing has become both more sophisticated and more scalable,” said Trevor Hilligoss, Chief Intelligence Officer at SpyCloud. “AI-generated lures, PhaaS platforms, and adversary-in-the-middle (AiTM) techniques are helping attackers capture not only usernames and passwords, but session cookies, refresh tokens, granting them authenticated access that can persist long after a password reset.”
Press release, provided by Globe Newswire on behalf of SpyCloud. Read the original.