Online Scams Surpass Phishing for the First Time, Akamai Report Finds

Bolster AI research featured in Akamai’s 2026 State of the Internet report found online scam detections approximately doubled from 3.2 million to 6.4 million during the reporting period, surpassing traditional phishing in Q1 2026. Average phishing attack lifespan fell from 48.3 days in Q4 2025 to 22 days in Q2 2026, while phishing detections still grew 61% by Q2 2026. The findings describe expanding, multichannel digital fraud rather than a company-specific earnings or outlook update.

Analysis

The investable implication is a possible shift in cybersecurity budgets toward external digital-risk monitoring and fraud disruption—not evidence yet of a larger, monetizable market for any named vendor. If enterprises respond, spending may migrate toward brand protection, takedown workflows, identity, and ad-channel monitoring, while endpoint and perimeter tools alone capture less of the incremental budget. That creates a potential product-bundling advantage for platforms that can connect threat discovery to remediation, but could also increase customer acquisition and analyst workload if detections rise faster than automation.

Treat the reported detection trends as directional, not an industry-wide incidence measure: this is vendor-contributed research, and the release does not disclose sampling, definitions, customer conversion, or revenue contribution. Akamai’s inclusion is not proof of commercial exposure or product wins; Bolster AI is not a listed-company catalyst. Over the next 1–3 months, look for independent corroboration in security-company calls, budgets, and bookings. Over 6–18 months, the structural test is whether external fraud protection becomes a recurring budget line rather than an add-on or incident-driven purchase. A reversal would be weak customer willingness to pay, poor remediation outcomes, or a lack of measurable renewal/upsell contribution.

Key Decisions for Investors

• No immediate directional trade: the signal is modest, vendor-sourced, and lacks evidence tying threat growth to incremental bookings or margins.
• Put Akamai and relevant security peers—including Cloudflare, Palo Alto Networks, and CrowdStrike—on an earnings-call watchlist; verify product exposure, attach rates, renewal/upsell, and whether external fraud protection is displacing or expanding existing security budgets. Use company names rather than inferred ticker mappings.
• Potential relative-value watch, not a current recommendation: favor vendors that demonstrate integrated detection-to-takedown capability over firms offering visibility without remediation. Enter only after independently reported customer adoption or guidance supports the thesis.
• Falsify the bullish sector read if upcoming commentary shows flat demand, no identifiable revenue contribution, or continued reliance on one-off services; also discount further headline detection growth unless the methodology and customer economics are disclosed.