What Is Spear Phishing and How Does It Differ from Regular Phishing?
A clear, direct answer to this question — written for UK business owners and IT decision-makers.
Direct Answer
Spear phishing is a targeted phishing attack directed at a specific individual, using personalised details — name, job title, recent activities — to make the message appear legitimate. Unlike mass phishing, spear phishing is crafted for a single target. It accounts for a disproportionate share of successful breaches because it bypasses both technical filters and user scepticism. AI has dramatically lowered the cost and time to produce convincing spear phishing emails at scale.
Key Points
What you need to know.
The Short Answer
Phishing is the number one attack type — 85% of businesses that experienced a breach identified phishing as the cause (DSIT 2025).
For UK Businesses
Phishing was the most disruptive breach for 65% of businesses.
Cost Considerations
93% of cyber crimes against businesses were phishing-based.
Next Steps
35% of businesses that experienced breaches reported impersonation of the organisation or staff.
Quick Comparison
| Feature | Option A | Option B |
|---|
Frequently Asked Questions
Finance teams, senior executives (CEO/CFO), HR staff, and IT administrators are the most frequent targets because they control funds, sensitive data, or system access. Attackers research their targets using LinkedIn, company websites, and social media to craft convincing messages. BEC attacks — a form of spear phishing targeting financial decision-makers — increased 33% in 2025 (FBI IC3 Report), making these roles particularly high-risk.
AI enables attackers to generate highly personalised, grammatically correct spear phishing emails at scale — previously, crafting each message required significant manual effort. AI can also mimic writing styles, generate deepfake voice messages for vishing attacks, and automate reconnaissance using publicly available data. With 85% of businesses that experienced a breach identifying phishing as the vector (DSIT 2025), AI-enhanced spear phishing is accelerating this already dominant threat.
Standard spam filters often miss spear phishing because the emails are individually crafted, come from legitimate-seeming domains, and may contain no malware or suspicious links. Advanced email security with AI-powered anomaly detection, impersonation protection, and DMARC enforcement significantly improves detection rates. However, no filter catches everything, which is why only 40% of UK businesses having MFA enabled (DSIT 2025) remains a critical gap when phishing succeeds.
Related Questions
What Is Phishing?
The broader phishing landscape — and how spear phishing differs from mass phishing campaigns.
Email Security and Phishing Protection
Advanced email filtering with anti-phishing controls that detect targeted spear phishing attempts.
Cybersecurity Guide for UK SMEs
How to defend against spear phishing and other targeted attacks as part of a layered security programme.
Protect your business → Get Cybersecurity Assessment