---
title: "Cyber security update: 2023’s phishing tactics"
description: We explore the latest research into phishing activity to help you be prepared and minimise the phishing risk to your organisation.
image: https://blog.grantmcgregor.co.uk/hubfs/phishing%20tactics.png
---
[](https://www.grantmcgregor.co.uk/)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
[Contact Us](https://grantmcgregor.co.uk/contact-us)
[Back to main](https://grantmcgregor.co.uk/knowledge-hub/blog)
Cyber Security
# Cyber security update: 2023’s phishing tactics
Grant McGregor Team
31 October 2023 • 5 min read
## Since the pandemic, email use has been rising rapidly. With more email use, comes greater risk of email-borne cyber threat. This article explores the latest research into phishing activity to help you be prepared and minimise the phishing risk to your organisation.
Mimecast’s The State of Email Security 2023 report posits that cyber risk now commands the C-Suite’s attention. Seventy-six percent of those surveyed expect an email-borne attack will have serious consequences for their organisations in the coming year.
This awareness is good news for cyber security leaders – provided that the C-Suite focus is accompanied with investment and resources.
Yet, the same report also highlights that the majority of data breaches can be tracked back to human error. By some estimates, 97 percent of users can’t recognise a crude phishing email when they receive one. C-Suite focus doesn’t automatically translate into wider staff understanding.
### Email threats are on the rise
What does this mean for your cyber security policies? And, in particular, what does it mean for dealing with the threat of email-based attacks, including phishing?
Mimecast says email remains the primary route of attack. With 82 percent of companies reporting a higher volume of email compared with the previous year, the risk is growing. Note that this builds on 79 percent reporting a rise in 2021 and 81 percent reporting a rise in 2020.
Unfortunately, this rise in email communications does directly translate into more email-based threats. According to the [2023 Mimecast survey](https://www.mimecast.com/state-of-email-security/), 74 percent of organisations have seen the number of malicious emails rise over the last year. When it comes to phishing specifically, 71 percent of large enterprises reported a significant rise in phishing attempts. This compares against 59 percent of smaller organisations reporting a significant rise in phishing.
Even for those not reporting a rise, such attacks remain widespread. Ninety-seven percent of respondents to the Mimecast survey said that their organisation had been the target of a phishing attack in the last year. In fact, it is estimated that 90 percent of corporate security breaches are the result of phishing.
### Some tried and tested methods of attack continue
Similarly, Proofpoint has warned of ongoing developments in the threat landscape. The security software vendor has investigated how attack chains have become more varied and delivery mechanisms are being rapidly tested and discarded. In its [The Human Factor 2023](https://www.proofpoint.com/uk/resources/threat-reports/human-factor) report, it warns that threat actors have begun to match their ingenuity to new-found patience.
The Proofpoint report warns that abusing our trust in familiar brands remains one of the cyber criminals’ favourite tactics. Its research shows that the top five abused and impersonated brands are: Microsoft 365, Microsoft Outlook, Amazon, Microsoft Excel Online and Microsoft SharePoint.
This impersonation tactic follows through to phishing attempts carried out on mobile phones (also known as “smishing”). Smishing activity tends to focus on package delivery notifications, with malicious actors impersonating delivery groups and ecommerce brands. This is a growing problem. Proofpoint reports that conversational attacks via mobile devices saw a twelve percent increase last year.
### Protecting yourself against phishing activity
Given the astonishing statistic around the lack of ability of staff to recognise a crude phishing email, it is clear that staff email security awareness training that focuses on helping people to recognise a phishing attempt remains worth investing in. This training needs to be regularly repeated and refreshed.
The Mimecast survey highlights respondents’ fears that they are well enough equipped to deal with the threat. It says 94 percent of respondents thought additional security measures are needed to supplement their Google Workspace or Microsoft 365 platforms’ native security functions.
While the native tools in Microsoft 365 might not be enough on their own, the other security tools within your Microsoft Enterprise licensing agreement should be enough to strengthen your security posture significantly. In addition to fine-tuning your email security policies, this includes deploying other security options, including multi-factor authentication tools, Microsoft Defender and setting appropriately tough policies in Autopilot, InTune and Security Centre.
### What next?
If you need help to strengthen your email security policies or configurations, please reach out to the Grant McGregor team.
Similarly, if you would like to find out more about the cyber security awareness training we offer which can help you staff to learn how to recognise phishing attempts, please see more here: [https://www.grantmcgregor.co.uk/cyber-security/safer-people](https://www.grantmcgregor.co.uk/cyber-security/safer-people)
For additional help or advice, get in touch.
Call us: 0808 164 4142
Message us: [https://www.grantmcgregor.co.uk/contact-us](https://www.grantmcgregor.co.uk/contact-us)
Further reading
You can find more ideas and advice about cyber security elsewhere on the Grant McGregor blog, including our latest articles published for October's Cybersecurity Awareness Month 2023:
- [What can we learn from the NCSC’s sixth Active Cyber Defence report?](https://blog.grantmcgregor.co.uk/what-can-we-learn-from-the-ncscs-sixth-active-cyber-defence-report)
- [What do we know about the Electoral Commission data breach? And what can we learn from it?](https://blog.grantmcgregor.co.uk/what-do-we-know-about-the-electoral-commission-data-breach-and-what-can-we-learn-from-it)
- [Update yourself on the latest thinking about ransomware](https://blog.grantmcgregor.co.uk/update-yourself-on-the-latest-thinking-about-ransomware)
- [The problem of shadow IT – and how to get the human factor right in cyber security](https://blog.grantmcgregor.co.uk/the-problem-of-shadow-it-and-how-to-get-the-human-factor-right-in-cyber-security)
- [New changes to Cyber Essentials for 2023](https://blog.grantmcgregor.co.uk/new-changes-to-cyber-essentials-for-2023)
- [What is a watering hole attack? And how can you protect against it?](https://blog.grantmcgregor.co.uk/what-is-a-watering-hole-attack-and-how-can-you-protect-against-it)
- [Do your backups include this important information?](https://blog.grantmcgregor.co.uk/do-your-backups-include-this-important-information)
- [Tips for successfully implementing a zero-trust approach to cyber security](https://blog.grantmcgregor.co.uk/tips-for-successfully-implementing-a-zero-trust-approach-to-cyber-security)
Grant McGregor Team
31 October 2023 • 5 min read
## Recent Posts
### Cyber Security Awareness Month: Why Attackers Still Target the Basics
Learn key cyber security practices for your organisation during Cyber Security Awareness Month. Protect against basic vu...
[Read More](https://blog.grantmcgregor.co.uk/cyber-security-awareness-month)
### Shadow AI: Is Your Business Ready for AI Adoption?
Understand shadow AI's impact on your business. Discover how to assess risks, improve processes, and adopt AI securely w...
[Read More](https://blog.grantmcgregor.co.uk/shadow-ai-is-your-business-ready-for-ai-adoption)
### Our Net Zero Target for 2040: What Can We Change?
From company vehicles and travel to suppliers and technology, see how Grant McGregor is working towards its net zero tar...
[Read More](https://blog.grantmcgregor.co.uk/our-net-zero-target-for-2040-what-can-we-change)
### What Is Penetration Testing? A Guide for Businesses
Learn what penetration testing is, how it works, what the report should include and when your business should consider a...
[Read More](https://blog.grantmcgregor.co.uk/what-is-penetration-testing-a-guide-for-businesses)
Union
## Empower your business with secure, expert-led solutions.
Talk to us about people-focused technology that drives results.
[Start a conversation](https://grantmcgregor.co.uk/contact-us)
Premium IT Services Tailored for Leading Brands
[Follow us on LinkedIn](https://www.linkedin.com/company/grant-mcgregor-ltd/) [Follow us on Facebook](https://www.youtube.com/itgrantmcgregor) [Follow us on Facebook](https://www.facebook.com/grantmcgregorltd/) [Follow us on Twitter](https://x.com/GrantMcGregorIT)
Quick Links
- [Home](https://grantmcgregor.co.uk)
- [About us](https://grantmcgregor.co.uk/about-us/our-story)
- [Knowledge Hub](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
Services
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
Edinburgh – Chesterfield
[0131 603 7910](tel:+441316037910)
[info@grantmcgregor.co.uk](mailto:info@grantmcgregor.co.uk)
**Main Office:**
The Merchants' Hall,
22 Hanover St,
Edinburgh EH2 2EP
© 2026
Grant McGregor. All rights reserved.
[Privacy and Cookie Policy](https://blog.grantmcgregor.co.uk/hubfs/UsefulDownloads/Policies/GRMC-SEC-Privacy-and-Cookie-Policy.pdf)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Grant McGregor Team",
"url" : "https://blog.grantmcgregor.co.uk/author/grmc-team"
},
"dateModified" : "2023-10-31T10:14:19.584Z",
"datePublished" : "2023-10-31T10:14:19.000Z",
"headline" : "Cyber security update: 2023’s phishing tactics",
"image" : [ "https://blog.grantmcgregor.co.uk/hubfs/phishing%20tactics.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.grantmcgregor.co.uk/cyber-security-update-2023s-phishing-tactics",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg"
},
"name" : "Grant McGregor"
}
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://grantmcgregor.co.uk/",
"@type" : "LocalBusiness",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "GB",
"addressLocality" : "Edinburgh",
"postalCode" : "EH2 2EP",
"streetAddress" : "22 Hanover Street"
},
"geo" : {
"@type" : "GeoCoordinates",
"latitude" : 55.9526313,
"longitude" : -3.1970679
},
"image" : "https://grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg",
"name" : "Grant McGregor",
"openingHoursSpecification" : {
"@type" : "OpeningHoursSpecification",
"closes" : "18:00",
"dayOfWeek" : [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ],
"opens" : "08:00"
},
"sameAs" : [ "https://www.facebook.com/grantmcgregorltd/", "https://x.com/GrantMcGregorIT", "https://www.youtube.com/itgrantmcgregor", "https://www.linkedin.com/company/grant-mcgregor-ltd/" ],
"telephone" : "+441316037910",
"url" : "https://grantmcgregor.co.uk/"
}
```