Slack and Teams Are the New Inbox for Phishing Attacks

Email is the channel defenders know best, and it shows. A fresh KnowBe4 survey of 169 security professionals at Infosecurity Europe found 83% are confident in their ability to stop email-based attacks. Step outside the inbox and that confidence collapses.

For Microsoft Teams, it drops to 61%. Social media sits at 51%. SMS and WhatsApp land at 50%. Slack, the channel most organisations now run their day on, comes in at just 40%. Half of respondents said their organisation has no strong confidence in detecting threats across messaging and social platforms at all.

The attackers have already moved

Sixty percent of those surveyed said attacks are already shifting beyond email, and more than half flagged collaboration tools as the most vulnerable channels in their environment. None of this should be surprising. A decade of investment in email security, secure gateways, link rewriting, banner warnings, phishing simulations, has produced a workforce that knows to squint at a sender address and hover over a link before clicking.

That same workforce has not, broadly speaking, been trained to apply the same scepticism to a direct message from a colleague's name in Slack, or a Teams call from someone claiming to be in IT, or a WhatsApp from a number that looks roughly like the CFO's. The trust people place in those channels is precisely what makes them useful to an attacker.

The training gap

The numbers on training are blunt. Only 41% of organisations regularly train staff on threats outside email. Thirteen percent never do. That's a meaningful slice of the workforce going about their day with no formal exposure to what a social-engineering attempt looks like in the tools they actually live in.

Javvad Malik, lead CISO advisor at KnowBe4, also flagged the obvious accelerant: AI is making impersonation in these spaces faster and more convincing. A voice clone on a Teams call, a polished DM in a colleague's tone, a fake screenshot dropped into a channel. The technical bar to pull any of that off has dropped considerably in the last 18 months, and it isn't going back up.

What the data is actually saying

The thing worth sitting with is the shape of the confidence gap itself.

• Email: 83% confident
• Teams: 61% confident
• Social media: 51% confident
• SMS / WhatsApp: 50% confident
• Slack: 40% confident

That isn't a story about email being solved. It's a story about defenders having spent ten years building muscle in one place while the rest of the body went unused. Tooling vendors will catch up on the collaboration side, eventually. The harder gap to close is the human one, because the instincts that protect people in an inbox aren't transferring automatically to a Slack DM.

The attackers have already noticed. The interesting question now is how quickly the rest of the industry stops treating the inbox as the whole perimeter.