Proofpoint says European phishing rose 4.5 times against 1.5 worldwide, but prints no detection counts

4.5 times is a point on an index, and the page prints no count behind it

Proofpoint's Threat Insight post "Europe's Threat Landscape in 2026: Espionage Expands as AI and Phishing Risks Grow" is dated November 12, 2026 on the page. It says "Phishing detections increased 4.5× year-over-year" in Europe and, in the body, that this outpaced "the 1.5× increase observed worldwide". The page prints no number of detections, messages, customers or organisations behind either multiple. Its Figure 1 is a line chart whose axis reads "phishing detections, indexed (Jul-25 = 100)", so the starting level is set to 100 by construction and the real starting level is not shown.

Derived: 4.5 divided by 1.5 is 3.0, so Europe's multiple is three times the world's multiple. That is a statement about growth from a starting month, not about how much phishing Europe receives.

What this does not establish. It does not show that Europe receives more phishing than any other region, because a region with a small starting level can post a large multiple while still having fewer detections than a region with a large one. It does not show that attackers have shifted towards Europe, because the page does not say whether the set of Proofpoint customers observed in Europe changed during the period. Proofpoint sells email and cloud security and wrote the post from its own telemetry, so its customer base, not the world, is the population.

Read time. The lead saved the page between about 12:30 and 13:00 UTC on 13 November 2026. This builder fetched the two chart images at about 12:38 UTC the same day, after reading the site's robots.txt. Anything Proofpoint changed after that is not included. The two charts are images, so the values quoted from them below were read off the image by this site (pixel positions against the gridlines, about plus or minus two index points) and are marked approximate.

Zoom

What the page prints, figure by figure

The page carries more figures than the headline pair. Each is listed below with the unit as printed and the base or population the page leaves out. Counts and ratios that this site worked out are in the next sections and are marked derived.

One index, three windows, three multiples for Europe

The text says "year-over-year". The chart does not start a year before its end: it starts in July 2025 and ends in September 2026, which is 14 months later (derived: July 2025 to July 2026 is 12 months, plus two). Its fifteen monthly points are indexed to the first month, so every line begins at 100 and the page never shows what 100 stands for.

The chart is Proofpoint's own figure, reproduced below. On this site's reading of the marker positions, the last points are about 592.6 for the UK, 436.1 for Europe and 149.1 for the World line (approximate). Divided by 100 that is about 5.9, 4.4 and 1.5 times (derived). The World reading fits the text's 1.5 times, and the UK reading is close to six-fold. The Europe reading does not quite fit: 4.5 times would sit at 450, which is 14 index points above where the line ends (derived), more than the reading error. The page does not say why.

Zoom

The same chart shows that the starting month is not a stable baseline. By February 2026 the three lines read about 70 (UK), 60 (Europe) and 52 (World), all below their starting level, and then they climb. A multiple therefore depends on the chosen start, as the table shows. Every value is derived from the chart readings and is approximate.

So "4.5 times" is the right description only of a chosen pair of months, and the page does not name the pair. The chart's own span fits best, and it is 14 months, not a year. This is not a claim that Proofpoint's figure is wrong; it is the reason a reader asks for the base and the window before using a multiple in a board paper.

Normalised for email volume, and silent on the customer base

The page does adjust for one thing. It says "Even accounting for higher email volumes, phishing increased at a faster rate, with detections per million inbound messages rising 3.2× across Europe". That is a per million rate for Europe only: the worldwide rate on the same basis is not printed, so the like for like comparison with 1.5 times cannot be made from the page.

Derived: 4.5 divided by 3.2 is about 1.4. If both figures use the same two windows and the same population (the page does not say they do), inbound email volume in Europe grew about 1.4 times over the period and explains part of the 4.5. That is this site's inference, not Proofpoint's statement.

What the page does not say is whether the set of customers observed in Europe grew, shrank or changed mix. This site's reasoning: a per million messages rate absorbs added volume, including volume from newly onboarded customers, but only if the same detections logic ran throughout, and the page does not describe the detections logic either. Words such as "customer base", "normalised" or "sample" do not appear in the post. The population is Proofpoint's customers in each region; the page never says how many.

Clicks: 8.3 against 2.0 per 100 delivered threats

The text says "Proofpoint observed 8.3 clicks for every 100 delivered threat messages in Europe, compared with 2.0 worldwide". Derived: 8.3 divided by 2.0 is 4.15 times. Figure 2 adds a UK bar at 7.6 (derived ratio to the world figure: 7.6 divided by 2.0 is 3.8). One click per 12 delivered threats in Europe is the same rate (derived: 100 divided by 8.3 is about 12).

The unit differs between the sentence and the chart. The sentence says threat messages. The chart's axis reads "threat-URL clicks per 100 delivered threats". A message can carry several links, and a delivered threat may carry none, so the two are not obviously the same measure. The page does not say how it counted a click (for example whether repeat clicks by one user count), over which period, or from how many messages or users. "Delivered" is not defined. This site's reading is that the message passed Proofpoint's filtering, in which case the rate also depends on what the filters let through in each region.

Zoom

Zoom

Cloud: 64 percent showed evidence of impact

The post's key findings say "In Europe, 64% of organisations targeted by precision attacks showed evidence of impact". A table in the body gives the pair: brute force 99% targeted and 33% impacted, precision attacks 98% targeted and 64% impacted. Derived: 64 divided by 33 is about 1.9, so precision attacks left evidence of impact in roughly twice the share of targeted organisations. Derived, and only if the 64% is a share of the targeted organisations as the sentence says: 0.98 times 0.64 is about 0.63, so roughly 63 percent of all organisations observed.

Three points about the wording. First, the page says "evidence of impact" and "impacted". It does not say "successful compromise", and it does not define impact. The next paragraph says "Compromise is often only the beginning", which implies a link but does not define the term. Second, the page does not say how many organisations are behind any percentage, or how Proofpoint observes them. Third, the 72% of organisations that "observed post-access activity" has no stated population: the page does not say whether it is a share of all organisations observed or of the impacted ones.

"Precision" is Proofpoint's label. The page defines it in one sentence: unlike broad brute force attacks such as password spraying, precision attacks "use more targeted techniques - including phishing and session hijacking - to compromise specific users and accounts". The comparison is between two categories that Proofpoint drew, so a reader should ask how an attack is assigned to each.

Espionage and AI: assessments, shares and no counts

The espionage section contains no figures about how many European targets were hit. It names actors and techniques and gives Proofpoint's assessments, for example that LLM use "has very likely accelerated" development by one actor and that LLM-assisted research "has accelerated exploit discovery" by another. The one frequency printed is that TA395 "initiates multiple distinct campaigns each week". No victim is named.

The AI section prints two numbers. More than 188,000 AI-enabled applications were seen "connected through authentication and OAuth frameworks", with no region or period. And the share of European sensors affected by attacks on open-source AI technologies rose 4.6 times "between consecutive 90-day periods". That is a ratio of two shares. Neither share is printed, so 4.6 times could be a move from a very small share to a small one. What a "sensor" is, the two 90-day periods and the count of exploitation attempts are not stated. The page names Langflow and LiteLLM as the open-source technologies involved.

The UK figures sit in the charts, not the text

The post sits on Proofpoint's UK site, and its two charts give UK values that the text does not. In Figure 1 the UK line ends highest of the three, near 593 on the index, about 5.9 times (derived, approximate). In Figure 2 the UK click bar is 7.6 per 100 delivered threats, below Europe's 8.3 and well above the world's 2.0. These are Proofpoint's figures from its own telemetry. The page does not say whether "Europe" includes the UK, so the 7.6 and 8.3 cannot be combined or subtracted. The text's UK reference is a list: the actor TA2730 is said to target organisations in the United Kingdom among seven countries.

What Proofpoint states, and what it does not

Where the page differs from itself

Four differences sit inside the page and its data, and they are left as differences here.

What to do, in order

Proofpoint's own advice. The page prints no list of recommendations. Its nearest statements are that the click gap underscores "the continued importance of the human layer" and that AI applications make "visibility and control over identities, applications and permissions increasingly important". Those are Proofpoint's.

This site's suggestions (not Proofpoint's), in the order worth doing:

Technical details

The post prints no hashes, domains, IP addresses, URLs, file names or detection rules, so there are no indicators to copy. What it prints are the figures and sentences that carry the claims, the chart axes, and the names of actors, techniques and tools. They are copied below so a defender can check the wording and map the names to their own detections.

The sentences that carry the multiples and rates. What it is: the page's own wording for each headline figure. What to do: hold any internal summary to this wording, and do not drop the unit or the word year-over-year.

Phishing detections increased 4.5× year-over-year.
phishing detections increased 4.5× across Europe year-over-year, significantly outpacing the 1.5× increase observed worldwide.
detections per million inbound messages rising 3.2× across Europe.
Proofpoint observed 8.3 clicks for every 100 delivered threat messages in Europe, compared with 2.0 worldwide
64% of organisations targeted by precision attacks showed evidence of impact.
The share of European sensors affected by attacks targeting open-source AI technologies increased 4.6× between consecutive 90-day periods.

The cloud table. What it is: the body table behind the 64% figure, laid out by this site as lines with the values exactly as the page prints them. What to do: compare your own targeted and impacted shares for password spraying style and for phishing and session hijack style attacks, using one definition of impact.

Brute-Force Attacks | Precision Attacks
Organisations Targeted | 99% | 98%
Organisations Impacted | 33% | 64%

The chart axes. What it is: the axis labels and legend of the two charts, read by eye from the saved images because the charts are pictures with no data table. What to do: note that the first chart is indexed and carries no unit counts.

Figure 1 (image file 01_phish_surge_indexed.png)
  y axis label: phishing detections, indexed (Jul-25 = 100)
  x axis: monthly, Jul-25 to Sep-26
  legend: UK, Europe, World

Figure 2 (image file 09_click_rate_scopes.png)
  y axis label: threat-URL clicks per 100 delivered threats
  bars: UK 7.6, Europe 8.3, World 2.0

Actors, techniques and tools named. What it is: the phrases in which the page names actors, kits and malware, copied as printed. What to do: use the names to search your own mail and identity logs and your intelligence feed. Detect the technique (device-code sign-in prompts, adversary-in-the-middle proxy sign-ins, unexpected remote management tools) rather than the name, because the page prints no indicators.

TA395, one of the most prolific actors observed in Proofpoint telemetry, initiates multiple distinct campaigns each week
TA488, for example, has used half-click exploits targeting Outlook, Zimbra, and other webmail providers
Other Russian actors have used device-code and App-Specific Password (ASP) phishing kits to gain access to inboxes without requiring victims to directly enter their credentials
the threat actor UNK_AcademicFlare
Adversary-in-the-Middle (AiTM) phishing kits, including both custom tooling and publicly available frameworks such as Evilginx
consent grants, stolen tokens, and overprivileged applications
exploitation attempts against open-source AI technologies such as Langflow and LiteLLM
UAC-0050 (also known as the DaVinci Group)
Remote Monitoring and Management (RMM) tools such as Remote Manipulator System (RMS)
the actor uses a W-8BEN tax form email phishing lure
TA2730 operates a real-time phishing kit
Mispadu (also tracked as Ursa Loader), Metamorfo (and its variant Horabot), Astaroth, Grandoreiro, and a newly observed payload identified as FluxEngine RAT
All campaigns are consistently geofenced

The question the post leaves open

If Proofpoint printed the number of detections in Europe in July 2025 and in September 2026, the number of customers observed in each month and the same figures for the world, would 4.5 times and 1.5 times still be the headline, and would they survive a different starting month?

Key facts