Nearly 90% of Cyberattacks Start in Your Inbox, Why Work Email Is Now the Weakest Link

You can buy the latest firewall, lock down Wi‑Fi, and install antivirus everywhere, and still get taken out by a single email.

That’s because the modern cybercriminal doesn’t need to batter down your network perimeter. They just need one employee to trust one message. And according to figures cited by French business outletLes Échos Solutions, roughly 90% of cyberattacks begin with phishing, an email designed to trick someone into clicking, paying, or handing over credentials.

For American businesses, the takeaway is blunt: your company inbox has become the front door. And attackers are getting better at picking the lock.

Table des matières

1 Why corporate email has become the easiest way in
2 The numbers behind the threat
3 How attackers actually weaponize your inbox
4 Spoofing, executive impersonation, and the wire-transfer trap
5 Account takeovers and data interception
6 The new twist: deepfakes enter the inbox war
7 A practical way to judge your company’s email risk
8 What a “secure-by-design” business email setup should include
9 Security isn’t just software, your people and settings matter
10 The hard truth: email is now a frontline system

Why corporate email has become the easiest way in

Email sits at the center of everything organizations do, contracts, invoices, HR documents, customer data, internal approvals. That makes it a high-value target for criminals running scams like phishing, spoofing (forged sender identities), and account takeovers.

Even companies with strong “perimeter” defenses can be exposed if their email systems, and the humans using them, aren’t prepared. One compromised mailbox can give an attacker access to sensitive threads, attachments, and an address book full of new targets.

The numbers behind the threat

French government-backed incident-response site Cybermalveillance.gouv.fr reported that phishing surged back to the top of the threats reported by professionals in 2024, accounting for nearly 21% of assistance requests and rising 12% in volume.

A separate survey from CESIN, an association of cybersecurity leaders at major French organizations, found 60% of companies named phishing as their top attack vector, ahead of software vulnerability exploitation (47%) and denial-of-service attacks (41%).

The impact isn’t theoretical. CESIN members reported that 47% suffered at least one significant cyberattack last year; data theft jumped to 42% (up 11 points), and 65% of attacked companies said their operations were significantly disrupted, meaning two out of three couldn’t work normally.

French e-commerce federation Fevad put the broader picture even more starkly: 67% of French companies said they were hit by at least one cyberattack in 2024, up 14 points from 2023. Nearly half reported losing prospects (47%), and 43% said they lost customers.

Fevad, citing Statista, estimated the total cost to France’s economy at more than €100 billion in 2024, about $108 billion at current exchange rates. The article also cites a grim statistic often repeated in small-business cybersecurity circles: a majority of victimized companies shut down within 18 months of a major incident.

How attackers actually weaponize your inbox

Phishing isn’t one trick, it’s an entire playbook. Criminals blast out mass emails with generic bait, then switch to spear-phishing when they want a specific person inside a company. The more tailored the message, the more dangerous it becomes.

Security firm Oodrive highlighted several variants seen in 2024: “smishing” via text message, “vishing” via phone calls, “quishing” using malicious QR codes, and “whaling”, the executive-impersonation scam that pressures staff into urgent wire transfers.

Spoofing, executive impersonation, and the wire-transfer trap

Spoofing works because it hijacks trust. An email appears to come from a CEO, CFO, or vendor, complete with a familiar tone and signature, then demands an immediate payment or a change to banking details.

Cybermalveillance.gouv.fr reported an increase in fraudulent wire-transfer orders in 2024. And globally, the FBI’s Internet Crime Complaint Center (IC3) has pegged cumulative losses from Business Email Compromise (BEC) at $55.49 billion from 2013 to 2023, with a 9% increase in the most recent year.

Technical defenses like SPF, DKIM, and DMARC can help verify senders and reduce spoofing. But they only work when configured correctly, and they’re not a magic shield if attackers compromise a real account or exploit human error.

Account takeovers and data interception

Plain-old mailbox hacking remains a major problem. Cybermalveillance.gouv.fr said compromised email accounts represented about 20% of professional assistance requests.

Once inside, attackers can quietly monitor conversations, steal attachments, and use the account to launch more convincing scams. And the risk doesn’t only come from outside your company, breaches at service providers can expose huge volumes of data.

In France, data tracked by RM3A showed 5,629 data-breach notifications filed with CNIL (France’s privacy regulator) in 2024, about 15 per day, with incidents affecting more than 1 million people doubling. For U.S. readers, CNIL plays a role similar to a national privacy watchdog, though the U.S. has a patchwork of state and sector rules rather than one single regulator.

The new twist: deepfakes enter the inbox war

CESIN’s 2025 barometer flagged a newer threat: deepfakes. They showed up in 9% of identified attack cases, think a fake video call from a finance executive paired with an urgent email demanding a transfer.

France’s national cybersecurity agency, ANSSI (roughly comparable to the U.S. Cybersecurity and Infrastructure Security Agency, or CISA), handled 4,386 security events in 2024, including 1,361 confirmed incidents, up 15%. Small and mid-sized businesses were heavily represented among ransomware victims, underscoring that attackers aren’t just hunting Fortune 500 targets.

A practical way to judge your company’s email risk

The article argues companies often make a mistake: choosing an email provider based on price instead of risk. A better approach starts with mapping what actually flows through email, customer data, contracts, payment instructions, intellectual property, HR files, and identifying what would hurt most if exposed.

Next, audit your current provider’s security posture. Is end-to-end encryption on by default or an add-on? Is the system “zero-access,” meaning even the provider can’t read your messages? What certifications back up the security claims, ISO 27001 or SOC 2 Type II, for example?

The piece also raises a sovereignty question that matters for global companies: U.S. cloud providers can be subject to U.S. legal demands for data under laws such as the CLOUD Act, even when data is stored abroad. That’s one reason some European organizations look to providers based in jurisdictions like Switzerland, which has strict privacy protections.

What a “secure-by-design” business email setup should include

At a minimum, the article argues, secure corporate email should include end-to-end encryption that starts on the user’s device, plus a zero-access architecture so stolen server data is useless without keys.

Independent security validation matters, too. Certifications like ISO/IEC 27001 and SOC 2 Type II don’t guarantee perfection, but they signal that controls have been audited and documented.

The article points to Proton, best known in the U.S. for Proton Mail, as an example of a provider built around encryption and Swiss jurisdiction. It says Proton’s services are used by more than 100 million people and 100,000 organizations worldwide, and that its business plans can include compliance support for GDPR (Europe’s privacy law), HIPAA (U.S. health data rules), and PCI (payment card standards), with storage tiers reaching 1 TB per user (about 1,000 gigabytes) shared with its cloud drive.

Security isn’t just software, your people and settings matter

Even the best platform won’t save a company if employees click the wrong link or type passwords into a fake login page. The article recommends a layered strategy: ongoing phishing training and realistic simulations, properly configured SPF/DKIM/DMARC, mandatory multi-factor authentication for every mailbox, and an incident-response plan that can be activated within hours.

It also urges organizations to keep up with threat intelligence and government alerts, ANSSI in France, and for U.S. companies, the closest parallel would be CISA advisories and industry-specific information-sharing groups.

The hard truth: email is now a frontline system

Work email used to feel like plumbing, important, but boring. The 2024 data paints a different picture: email is the top entry point for attacks, and a single compromised inbox can trigger financial loss, data exposure, and operational shutdown.

Companies that treat email as mission-critical infrastructure, and choose tools and policies based on risk, not sticker price, stand a better chance of staying on their feet when the next convincing message lands in someone’s inbox.