The two percentages in that column are doing less work than they look like they are doing. A 1,265% increase in phishing through late 2024 [3] means volume finished at 13.65 times where it started [16]. The 442% vishing figure over the same period [4] works out to 5.42 times [17]. Neither number arrives with a base count, a named dataset, or a breakdown by victim size in the text supplied [19], so they describe the direction of message volume and say nothing about how many 200-person companies were on the receiving end.
The figure that carries the argument is the three hours [2]. Attacker time was the scarce input, and scarce inputs go to the biggest expected payout. That is triage, and triage is what kept the small manufacturer off the list, not anything the manufacturer did [1].
Compressed reconnaissance moves that cost from per-target to per-pipeline. According to the column, the same tooling that writes the lure also picks which employee to approach, works out which systems that person can reach, and drafts the pretext, doing each stage adequately rather than well [11]. Once the marginal cost of the five hundredth target sits close to the cost of the first, revenue stops being a useful sort key and conversion probability replaces it. A company with one controller, an informal approval chain, and a help desk that resets passwords over the phone scores high on that key.
The guardrail debate is where operators get misdirected. ChatGPT, Claude, and Google Gemini make voice cloning difficult; a local model on a laptop does it without strain [6], and the sample can come from a YouTube clip of the chief executive speaking at a chamber of commerce event [7]. The column names three uses for the resulting call: authorizing a wire transfer, changing direct-deposit details, and talking a help desk representative into a password reset [8]. All three are procedures. That is also where the fix sits, at the price of friction rather than licences: a callback to a number of record before money moves or a credential changes, because voice recognition as an informal verification step is spent [9].
None of this is an incident report. There is no victim, no CVE, no dwell time, and the piece is a commentary column rather than telemetry [18]. Read it as a pricing update on attacker labour. A risk register that still ranks likelihood by employee count is charging for a deterrent the seller has withdrawn.
