Norn Labs: Safe Browsing misses 84% phishing

This is a strong data point on real-time phishing detection limits, but it is still vendor-run benchmarking that needs independent replication.

• –The report’s core claim (83.9% missed) is specific and transparent about sample size, which makes it notable.
• –Norn positions Muninn as a two-layer model (automatic URL/heuristic scan plus deeper visual scan) rather than pure blocklist matching.
• –The biggest practical takeaway is attacker abuse of reputable hosts (for example site builders and cloud platforms) where domain-level blocking is ineffective.
• –Because the evaluation is produced by the tool vendor, developers and security teams should treat it as directional evidence, not definitive industry truth.