2026 Email Threats Report

In January 2026, Barracuda Research analyzed more than 3.1 billion emails, looking at malicious, spam or unwanted emails and identifying trends. Their report outlines how AI and phishing-as-a-service are reshaping the email threat landscape and how to stay protected

AI-driven social engineering and phishing-as-a-service (PhaaS) are increasing both the volume and effectiveness of email-based attacks. The report shows that attackers are scaling credential phishing, shifting from file-based payloads to URL-based delivery, and using QR codes and account takeover (ATO) to bypass conventional controls. This report summarizes the most common attack types, the highest-risk attachment and link behaviors, and practical steps to reduce risk across email, identity and endpoints.

Blueprint to Execute Data-Driven Risk Assessments

Most organizations still rely on qualitative risk assessments that label exposure as high, medium, or low but fail to show the financial impact behind those ratings. That makes it harder for IT leaders to justify mitigation investments, align response plans to risk appetite, and communicate risk in financial terms that executives and boards can use to justify investment decisions.

Step-by-step blueprint to quantify risk and drive better decisions
InfoTech Research Group offers data-driven risk assessments. Their tools and research help you move from descriptive risk scoring to decision-grade risk insights by applying a blended approach that uses both qualitative and quantitative analysis. Use the tools to identify key risks, prioritize severe exposures, estimate financial impact, and equip risk owners with the information needed to make better decisions.

The blueprint includes:

• Risk Assessments Storyboard
• Risk Assessment Workbook
• Risk Owner Communication Template