2021 Email Security Vulnerability Report
How often malicious test emails got past email security tools in 81 companies, by attack vector and industry.
Archive edition. This report uses email security tests from 2018 to 2020, and email security tools have changed since. The finding that many malicious emails can reach the inbox past filters is a reason to plan for detection and response. See the latest
What the data shows
- 604,310Malicious test emails were sent to 81 companies between 2018 and 2020 to see which attack vectors got through.Page 4, in the full report
- 9.44%Only 9.44% of the checked test emails were blocked by the companies' security tools.Page 5, in the full report
- 280,452Test emails could not be checked, so they are left out of the inbox and blocked rates.Page 5, in the full report
- 4Of the seven attack vector types tested, four reached the inbox more than 90% of the time.Page 6, in the full report
Start reading
- 1 / 17
- 2 / 17
- 3 / 17
Read the other 14 pages
They open right here. You can also download the PDF.
Tap a page to read it full size.
What the report covers
- Report methodology
- Key findings
- Advanced Persistent Threat (APT)
- Phishing & spear-phishing attacks
- Misconfiguration
- 2018-2020 ransomware samples
- Malicious attachments
- Conclusion
Who it is for
Security teams who want to know how often malicious emails can get past standard email security tools.
How the data was collected
- Sample
- 604,310 malicious test emails sent to 81 companies
- Period
- 2018 to 2020
- Source
- Email security assessments run with Keepnet's Email Threat Simulator, shared anonymously
- Note
- 280,452 emails could not be checked and are excluded from the rates. Only 81 of the more than 300 companies that used the tool agreed to share their data.
Cite this report
Keepnet (2021). 2021 Email Security Vulnerability Report. https://keepnetlabs.com/reports/2021-email-security-vulnerability-report
Figures on this page may be quoted with this citation.
Incident Responder
Turn employee reports, including SMS and calls, into analysed signals your team can act on.
About this report
Organisations set up a dedicated, restricted test inbox with their standard security settings. Malicious test emails were then sent to it, and any email that reached the inbox counted as a risk.
APT, phishing and spear-phishing, misconfiguration, 2018-2020 ransomware samples, malicious attachments, browser exploits and file format exploits.
Technology ranked first, followed by Consulting, Financial Services, Education and Real Estate. The report gives a ranking only, with no rates per industry.
Keep reading
The Mobile Phishing Visibility Gap
~40%higher click rate on phone-based simulations than on email (Verizon DBIR 2026).Read the key findings
Cut Human-Driven Incidents: A CISO Playbook for Measurable Behaviour Change
76% vs 60%Most large firms train employees, yet human factors still sit behind most breaches.Read the key findings
2025 New Hires Phishing Susceptibility Report
44%more susceptible to phishing: new hires in their first 90 days compared with tenured employeesRead the key findings
2024 Voice Phishing (Vishing) Response Report
6.5%of 3,279 employees called shared sensitive information during simulated vishing calls.Read the key findings
The State of the Smish Report 2023
74%of organisations experienced a smishing attack in 2021, according to Safety Detectives.Read the key findings
MSSP Business Model
$1.3 millionis the payroll an in-house team can reach once it staffs its own 24x7 SOC, according to Cipher.Read the key findings
2020 Phishing Trends Report
50.42%of simulated phishing emails were opened by the target in 2019.Read the key findings
Threat Sharing
206 dayswas the average time to detect a breach, according to IBM's 2019 Cost of a Data Breach Report.Read the key findings
See how Keepnet would act on these findings for you
- Run multi-channel simulationsFrom email through to deepfake.
- See reporting outcomes and the behaviour scoreReporting, repeat behaviour and remediation, in one board report.
- Explore AI agents and automationSee how simulations, training and follow-up can run with less manual work.
Book a 30-minute demo
Thirty minutes, no cost and no obligation.
Thank you, your request is in
A confirmation is on its way to your inbox.
Thirty minutes with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your demo is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tab