The threat landscape, at a glance.
What the numbers look like across the board.
Malicious email vs clean email
Share of all mail across organisations — malicious mail (malware and spam) vs clean delivery.
- Clean (Delivered) — 93.6%
- Malicious (Malware/Spam) — 6.4%
- Clean
- Malicious
Malicious vs spam
Split of the bad-mail bucket — of all bad mail: malicious (quarantined by Defender) vs spam (delivered to Junk).
- Malicious (quarantined) — 38.4%
- Spam (delivered to Junk) — 61.6%
- Malicious
- Spam
Malicious mail detection
Defender-protected organisations only. The volume of malicious mail a good mail defender removes from your inbox.
- Delivered clean — 97.5%
- Removed by Defender — 2.5%
- Delivered
- Removed
Attack types — email vs sign-ins
Where attackers are spending their time — inbox malware/phishing vs credential-stuffing on sign-in endpoints.
- Email — 31.3%
- Sign-ins — 68.7%
- Sign-ins
Brute force sign-in attacks
Botnet-driven vs single-origin brute-force attempts, and how many organisations are currently under active attack.
- Botnet — 53.8%
- Single origin — 46.2%
- Botnet
- Single origin
- Not under attack — 79.7%
- Under attack — 20.3%
- Not attacked
- Under attack
Attack risk mix
Share of attack instances by risk level.
- High risk — 52.2%
- Low risk — 0.5%
- Medium risk — 47.3%
- High
- Low
- Medium
Updated 16 Jul 2026, 01:15 am · These charts are populated with collated security data collected by Decision1 IT Solutions Ltd. The data is accurate to the data we collect from our own sources, and are not compared to, or drawn from, any other source.