Everywhere, all at once – Why messaging is still the attackers’ killer app

Cyber security headlines focus on spectacular multimillion-dollar ransom payments, global password breaches, AI-powered nation-state attacks and deepfake scams. But the way attackers actually get into Australian businesses hasn’t changed much in twenty years.

Bad actors send a lot of messages. Eventually, someone opens one, clicks, replies or shares a credential. The door gets opened from the inside with no clever tricks.

Nexon’s penetration testing across 126 Australian organisations found that phishing and social engineering were the most reliable ways to gain access.¹ These findings are consistent with Check Point Research’s AI Security Report 2025² and the 2025 Gartner Magic Quadrant for Email Security,³ which both underline how central email and messaging remain to most attacks.