What Microsoft’s Email Security Benchmark Reveals About Today’s Phishing Threats

Last week Microsoft released its first full year of email security data from Defender for Office 365. The benchmark aggregates anonymized threat detection rates across millions of Microsoft 365 mailboxes. While the numbers come from a corporate security product, the patterns are relevant to anyone who uses email — which is everyone.

Here’s what the data shows, what it means for your inbox, and a few practical steps you can take without needing an IT department.

What the data shows

Microsoft’s benchmark, published June 15, 2026, covers phishing, spoofing, and malware attempts detected by Defender between June 2025 and May 2026. Key findings include:

  • Phishing volume remained high – On average, Defender blocked over 12 million phishing emails per month across the measured environment. That’s roughly one in every 200 inbound messages.
  • Spoofing attempts declined – After Microsoft enforced stricter DMARC validation for custom domains, spoofed messages dropped by about 40% compared to the previous period.
  • Malware attachments shifted – Traditional .exe and .doc macro attachments fell, while attackers increasingly used password-protected archives and OneDrive links to evade scanning.

It’s important to note these numbers come from environments that have Defender for Office 365 enabled. Organizations without that protection likely see higher volumes of threats land in inboxes.

Why it matters for your inbox

If you use a personal or business Microsoft 365 account (Outlook.com, Office 365 Business, or Microsoft 365 Family), these trends affect you directly.

The persistence of phishing means that even with good filters, some messages will slip through. Attackers constantly adjust their tactics to bypass detection. The shift toward link-based phishing (fake login pages shared via Office 365 services) is a prime example. These messages often look legitimate because they come from a real Microsoft domain or a compromised account you know.

The spoofing decline is good news, but it mainly helps people who own custom domains (like @yourcompany.com). If you have a standard @outlook.com or @hotmail.com address, spoofing protections are managed by Microsoft and have been solid for years.

Practical steps to improve email security

You don’t need to be an IT admin to reduce your risk. Here are four things worth doing, based on the patterns in the benchmark:

  1. Make sure Defender is on
    If you have a Microsoft 365 Business subscription that includes Defender for Office 365, confirm it’s enabled for your account. Go to the Microsoft 365 Defender portal (security.microsoft.com) and check your threat policies. Free Outlook.com users get basic protection, but business licenses include anti-phishing and anti-spoofing features that can be tuned.

  2. Enable multi-factor authentication (MFA)
    This is the single most effective control against account takeover. The benchmark data doesn’t cover MFA adoption, but every phishing report from the real world shows that MFA stops the majority of credential theft attempts. If you’re not using it, turn it on in your account security settings.

  3. Be cautious with shared links and attachments
    Because attackers now favor OneDrive and SharePoint links, treat any unexpected file-sharing request with the same suspicion as an attachment. If a colleague sends you a document you weren’t expecting, verify through another channel before clicking.

  4. Report phishing in your inbox
    Use the “Report phishing” button in Outlook (or the add-in if you’re on the web). That feedback helps Defender’s algorithms improve over time. Microsoft uses aggregated reports to update its models, which benefits everyone.

Limitations of the benchmark

The benchmark is specifically for Microsoft 365 customers using Defender for Office 365. If you use Gmail, iCloud Mail, a personal email provider, or a different corporate system, the numbers will be different. The underlying threat landscape is similar, but the detection rates and filtering capabilities vary significantly.

Additionally, Microsoft has a financial interest in showing its product performs well. The data is real, but it’s drawn from an environment where the product is optimally configured. Individual results will vary.

Sources

  • Microsoft Security Blog – “Microsoft Defender email security benchmarking: Key insights from one year of data” (June 15, 2026)
  • Microsoft Security Blog – “Clarity in complexity: New insights for transparent email security” (December 10, 2025)
  • Microsoft Security Blog – “From transparency to action: What the latest Microsoft email security benchmark reveals” (March 12, 2026)