One in every 99 emails is a phishing attack, and a new study shows 25% of those phishing attacks bypass default security measures built into Office 365, researchers reported today.

The data comes from Avanan’s Global Phish Report, which analyzed 55.5 million emails sent to Microsoft Office 365 and Google G Suite accounts. They found roughly 1% of all messages are phishing threats that use malicious attachments or links as the attack vector. Of those, 25% were marked safe by Exchange Online Protection (EOP) built into Office 365 and delivered to users.