---
title: "The Phishing Threat Now: A 2021 Update"
description: The pandemic was boom time for cyber criminals. What can companies do to protect themselves from such email-based cyber threats?
image: https://blog.grantmcgregor.co.uk/hubfs/phishing%20threat.png
---
[](https://www.grantmcgregor.co.uk/)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
[Contact Us](https://grantmcgregor.co.uk/contact-us)
[Back to main](https://grantmcgregor.co.uk/knowledge-hub/blog)
Cyber Security
# The Phishing Threat Now: A 2021 Update
Grant McGregor Team
16 November 2021 • 4 min read
# According to the FBI, phishing incidents doubled in frequency during 2020. The pandemic was boom time for cyber criminals, with nearly a quarter of a million phishing attempts reported in the USA alone.
What can companies do to protect themselves from such email-based cyber threats?
Unlike other cybercrime attack vectors, people are key to protecting your organisation from phishing attacks. This means staff education and awareness raising measures hold the key to your successful defence against them.
To understand why, let’s look at some of the facts around phishing.
### Phishing remains the top threat action
A recent report compiled by US tech giant Verizon has found that phishing continues to be the top threat action in successful cyber breaches.
In 85% of breaches linked to social engineering, the cyber criminals successfully stole login credentials and other information targets.
Similarly, an earlier Mimecast survey about email-based attack vectors in 2021 showed that 60% of organisations were hit by attack that spread internally from an infected user to other employees.
### Cyber criminals exploit trust in public sector organisations
Throughout the pandemic, many of us have turned to respected institutions like the NHS and HMRC for information and support.
Cyber criminals have been quick to understand this and, over the last 18 months, have been busy hijacking respected and trusted public sector brands.
HMRC has investigated more than 10,000 scam emails, SMS messages, social media posts and phone calls that have exploited its name.
The National Cyber Security Centre (NCSC) has taken down more than 15,000 malicious campaigns related to COVID-19.
And it isn’t just cyber criminals who have exploited the crisis. State-sponsored cyber threats have also been reported, with Russian malware targeting pharmaceutical companies and research organisations to steal valuable intellectual property.
### Which industries are most at threat?
Cyber security awareness business KnowBe4 has introduced the concept of the “Phish-Prone Percentage” or PPP. A higher PPP indicates a greater risk, as it points to a higher number of employees typically falling for phishing scams.
To calculate each organisation’s PPP, the company measures the number of employees who clicked on a simulated phishing email link or opened a simulated infected attachment during a test spoof-phishing campaign.
Shockingly, it found that in 2021 the average phish-prone percentage across all industries and organisation sizes was 31.4%. This means nearly a third of staff are likely to click on a suspicious link or open a suspicious file.
The survey found that the organisational profiles at highest risk of falling victim to a phishing attack included: large energy and utility businesses; large insurance firms; large banks; mid-size energy and utility firms; large healthcare and pharmaceutical organisations.
KnowBe4 suggests the sudden shift to home working was particularly difficult for large businesses to manage and this accounts for the fact that larger businesses typically having a higher phish-prone percentage in this year’s findings.
### What can you do to guard your organisation against phishing scams?
There are some technological solutions that can help to guard against phishing, including email security tools and email filtering rules.
However, when it comes to phishing, the best line of defence is definitely your people.
The KnowBe4 survey looked at organisations who undertook email security awareness training for staff and the effect this training had on their susceptibility to email-based cyber-attack.
It found that after just three months of security awareness training for staff, the average PPP score dropped from 31.4% to just 16.4%.
Just three months of training can almost half the risk.
The survey then looked at what happened if that email security awareness training programme was continued for a year. It found that after twelve months, the risk dropped from 31.4% to just 4.8%.
The effectiveness of training was demonstrated across all industry sizes and all verticals. It’s clear that training and reinforcement can have a huge impact on an organisation’s ability to protect itself against the most common type of cyber-attack.
It’s difficult to think of another area of cyber-security where such a small investment can have such a dramatic protective effect.
### Next steps?
Read our blog about [Mimecast’s 2021 survey on email security](https://blog.grantmcgregor.co.uk/the-state-of-email-security-update).
Or, if you have any questions about this article or about email security awareness training, please speak with our team:
[](https://cta-redirect.hubspot.com/cta/redirect/6138324/cb591c8f-afbb-49d7-8676-9f2762c58b37)
Grant McGregor Team
16 November 2021 • 4 min read
## Recent Posts
### Shadow AI: Is Your Business Ready for AI Adoption?
Understand shadow AI's impact on your business. Discover how to assess risks, improve processes, and adopt AI securely w...
[Read More](https://blog.grantmcgregor.co.uk/shadow-ai-is-your-business-ready-for-ai-adoption)
### Our Net Zero Target for 2040: What Can We Change?
From company vehicles and travel to suppliers and technology, see how Grant McGregor is working towards its net zero tar...
[Read More](https://blog.grantmcgregor.co.uk/our-net-zero-target-for-2040-what-can-we-change)
### What Is Penetration Testing? A Guide for Businesses
Learn what penetration testing is, how it works, what the report should include and when your business should consider a...
[Read More](https://blog.grantmcgregor.co.uk/what-is-penetration-testing-a-guide-for-businesses)
### Grant McGregor Recognised as a Leading Global MSP in the 2026 MSP 501
Grant McGregor has been named a Top Global Managed Service Provider in the 2026 MSP 501, ranking #1 Scotland-based MSP a...
[Read More](https://blog.grantmcgregor.co.uk/grant-mcgregor-recognised-as-a-leading-global-msp-in-the-2026-msp-501)
Union
## Empower your business with secure, expert-led solutions.
Talk to us about people-focused technology that drives results.
[Start a conversation](https://grantmcgregor.co.uk/contact-us)
Premium IT Services Tailored for Leading Brands
[Follow us on LinkedIn](https://www.linkedin.com/company/grant-mcgregor-ltd/) [Follow us on Facebook](https://www.youtube.com/itgrantmcgregor) [Follow us on Facebook](https://www.facebook.com/grantmcgregorltd/) [Follow us on Twitter](https://x.com/GrantMcGregorIT)
Quick Links
- [Home](https://grantmcgregor.co.uk)
- [About us](https://grantmcgregor.co.uk/about-us/our-story)
- [Knowledge Hub](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
Services
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
Edinburgh – Chesterfield
[0131 603 7910](tel:+441316037910)
[info@grantmcgregor.co.uk](mailto:info@grantmcgregor.co.uk)
**Main Office:**
The Merchants' Hall,
22 Hanover St,
Edinburgh EH2 2EP
© 2026
Grant McGregor. All rights reserved.
[Privacy and Cookie Policy](https://blog.grantmcgregor.co.uk/hubfs/UsefulDownloads/Policies/GRMC-SEC-Privacy-and-Cookie-Policy.pdf)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Grant McGregor Team",
"url" : "https://blog.grantmcgregor.co.uk/author/grmc-team"
},
"dateModified" : "2021-11-17T14:17:13.939Z",
"datePublished" : "2021-11-16T15:39:54.000Z",
"headline" : "The Phishing Threat Now: A 2021 Update",
"image" : [ "https://blog.grantmcgregor.co.uk/hubfs/phishing%20threat.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.grantmcgregor.co.uk/the-phishing-threat-now-a-2021-update",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg"
},
"name" : "Grant McGregor"
}
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://grantmcgregor.co.uk/",
"@type" : "LocalBusiness",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "GB",
"addressLocality" : "Edinburgh",
"postalCode" : "EH2 2EP",
"streetAddress" : "22 Hanover Street"
},
"geo" : {
"@type" : "GeoCoordinates",
"latitude" : 55.9526313,
"longitude" : -3.1970679
},
"image" : "https://grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg",
"name" : "Grant McGregor",
"openingHoursSpecification" : {
"@type" : "OpeningHoursSpecification",
"closes" : "18:00",
"dayOfWeek" : [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ],
"opens" : "08:00"
},
"sameAs" : [ "https://www.facebook.com/grantmcgregorltd/", "https://x.com/GrantMcGregorIT", "https://www.youtube.com/itgrantmcgregor", "https://www.linkedin.com/company/grant-mcgregor-ltd/" ],
"telephone" : "+441316037910",
"url" : "https://grantmcgregor.co.uk/"
}
```