Email is the primary infiltration mechanism for the majority of cyber-attacks. To effectively combat these attacks, organisations need to understand the types of identity deception attackers typically prefer, the relative risk and cost of attacks to businesses and the likelihood of their success.