Assertion Contradicted AI assessment confidence: 95% certainty 4/5 debate potential 1/5

Falkowitz: Verizon report shows 50% phishing success by third message

Oren Falkowitz · Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital) · Oct 21, 2015 · at 6:08

Oren Falkowitz, founder and CEO of Area 1 Security, references Verizon's annual data breach investigations report.

0:00 / 0:11exact quote · 11.2s

▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark

“Verizon yearly does a breach, a report on all the breaches that they responded to, and they found that by the third message that gets sent, 50% of the success rate is, is already achieved, right?”

quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →

The claim, plainly

According to Verizon's data breach report, sending three phishing messages achieves a 50% success rate.

a quote alone can be ambiguous, so this restates it with the references and context of the conversation around it resolved. AI-written; the tape below the player is the source.

Assessment

The claim misattributes the statistic to Verizon. The 2015 Verizon Data Breach Investigations Report (DBIR) does not state that sending three phishing emails achieves a 50% success rate. Instead, Verizon reported that sending 10 emails yields a greater than 90% chance of at least one click, and that nearly 50% of opens and clicks happen within the first hour. The 'three emails yield a >50% success rate' statistic comes from contemporary research by ThreatSim, not Verizon.

2015 Verizon DBIR page 13 states that a campaign of 10 emails yields a >90% chance of at least one victim, with no 3-message/50% success rate metric included.
Verizon DBIR uses 50% to describe timing (nearly 50% open/click within the first hour), not message count.
Contemporary 2014-2015 ThreatSim research found that 3 phishing emails give an attacker a >50% chance of getting a click.

Checked against

[1] verizon.com [2] phishingbox.com [3] amazonaws.com [4] verizon.com [5] verizon.com [6] crn.com [7] castlerockagency.com [8] journaloflegalstudiesinbusiness.org

Verizon DBIR 2015 phishing 10 emails 50 percent three emails "campaign of" "e-mails" verizon DBIR Verizon Data Breach Investigations Report 2015 phishing success rate 3 emails "three phishing" verizon "data breach" "three" phishing "50%" OR "50 percent" verizon "data breach"

assessed as of 2026-07-31

This assessment is an AI reading of a public statement, made against the cited references with the confidence shown. It can be wrong. The quote, the tape and the references are all on this page; if something is off, use report an error below. full disclaimer →

Mentioned

phishing messages Verizon

⚑ Spot an error? Report it

More from Oren Falkowitz

Opinion

Falkowitz: Training employees to spot phishing attacks does not work

“So I'm gonna train all of you to spot phishing. That's not gonna work, right”

Oren Falkowitz Oct 21, 2015 ▶ 17:00 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Assertion Not checkable as stated

Falkowitz: Area 1 Security has captured the entire internet for security

“What we've been able to do is capture the entire Internet, right, in a way that maybe you would think Google or others do, right, and to do that for a very specific sort of security purpose.”

Oren Falkowitz Oct 21, 2015 ▶ 11:43 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Assertion Not checkable as stated

Area 1 Data: Top spam filters miss 9 targeted phishing emails per million

“Our data shows that for every one million messages a company receives, nine of them are of a targeted and sophisticated nature that the best spam, Google spam, others are going to miss, right?”

Oren Falkowitz Oct 21, 2015 ▶ 17:23 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Assertion Partly supported

Falkowitz: 97% of all cyberattacks begin with phishing

“97% of all attacks Begin with phishing.”

Oren Falkowitz Oct 21, 2015 ▶ 5:15 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Assertion Partly supported

Ten phishing emails yield a 90 percent success probability within 90 seconds

“If you send just 10 messages to a company, there's a 90% success rate that one of those users is going to click, and it takes less than 92nd, is this videotape, by the way? It takes, and it takes less than 90 seconds, right, for that to happen.”

Oren Falkowitz Oct 21, 2015 ▶ 5:48 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Assertion Partly supported

Falkowitz: Companies take a year to discover cyberattacks after phishing starts

“These companies are only learning about these attacks a year after this initial phishing starts, right?”

Oren Falkowitz Oct 21, 2015 ▶ 6:37 Oren Falkowitz, Area 1 Security // The Future of Cybersecurity (Hosted by FirstMark Capital)

Falkowitz: Verizon report shows 50% phishing success by third message

More from Oren Falkowitz

Turn any episode into a week of clips.