Brussels – Three out of four employees in the European Union have come across suspicious emails, messages, or links at work. These are the findings of a new survey Eurobarometer published today (30 September) by the European Commission. Conducted online between 27 April and 8 May, the survey on “Cybersecurity in the workplace: employee awareness and preparedness” involved 25,747 EU citizens across all 27 Member States and covered incidents that had occurred in the previous six months.
The most common cyber threat in the workplace is phishing, which is a type of scam that aims to deceive people into providing personal information, login details, and financial data. 39 per cent of employees reported fraudulent messages or websites designed to steal data or gain unauthorised access. Employees also reported attempts to steal personal data (18 per cent) and passwords (16 per cent), malware attacks (17 per cent) and scams generated by artificial intelligence (AI) (15 per cent).
However, there is a considerable gap between awareness and the ability to detect threats. The data shows that, while 83 per cent consider the potential consequences of cyber-attacks to be serious, only 48 per cent say they can recognise a fake video generated by AI. And, overall, just 18 per cent state that their organisation has not suffered any cyber incidents, as far as they are aware.
The situation is different when it comes to risky behaviour. Here, employees have a more trained eye and know how to recognise such behaviour, particularly with regard to phishing and password management. Among those who use digital systems and tools at work, 76 per cent consider it risky to click on a link without checking the sender. A similar proportion (74 per cent) consider it dangerous to use the same password for both personal and work accounts, while 69 per cent believe that sharing work-related information on social media is risky. Most employees are also aware of the need to report suspicious emails and to install software updates.
However, this awareness often does not translate into everyday practice. Although 72 per cent say they know how to spot suspicious emails, only 54 per cent check the sender before opening links, and just 50 per cent always lock their computer when stepping away from their workstation. Furthermore, fundamental cyber hygiene practices, such as checking the sender before opening links and using strong passwords, are widely known but not consistently applied among workers, with compliance increasing significantly with age: awareness of cyber risks increases significantly with age, highlighting the need for targeted training, particularly for younger employees (aged 15–24).
Finally, it is worth noting that most employees believe their organisation is effective at protecting itself against cyber-attacks, but that only around half of organisations have implemented key cyber-security measures, while a further quarter plan to introduce them. Six in ten employees (60 per cent) said they had received cybersecurity training in the past year, although participation drops sharply in smaller organisations. At the same time, 85 per cent said they were interested in improving their cybersecurity skills, but the main obstacle to doing so is a lack of time (in 26 per cent of cases).
Italian photography
The Eurobarometer survey involved just over a thousand Italian citizens (1,003). The data confirm the overall picture: phishing emails were the risk to which respondents’ employers were most exposed (36 per cent, EU average 39 per cent), followed by attempts to steal personal data (17 per cent, EU average 18 per cent), malware attacks (17 per cent for both Italians and the EU average) and attempts to steal passwords (14 per cent, EU average 17 per cent).
However, the data reveals that respondents are highly aware of the importance of cyber security: 55 per cent of respondents consider it very important, and 32 per cent consider it quite important (the EU averages are 53 per cent and 33 per cent respectively). Furthermore, the consequences of a potential cyberattack on their workplace are perceived as very serious by 29 per cent of Italian respondents (EU average: 37 per cent) and quite serious by 53 per cent (EU average: 46 per cent). Added to this is a sense of unease felt by almost half of those surveyed, given that 17 per cent consider it “very likely” and 32 per cent “quite likely” that their company will suffer a cyber-attack in the next six months (EU averages of 18 per cent and 31 per cent).
In terms of response, more than three in four employees endorse the protection systems and tools provided by their company: 20 per cent (EU average 24 per cent) consider them very effective and 62 per cent (EU average 58 per cent) consider them fairly effective. Furthermore, in around half of cases, companies have implemented a security measure: written rules and guidelines (51 per cent); procedures and channels for reporting issues (45 per cent); and information and awareness-raising messages about risks (45 per cent). Finally, 24 per cent of Italians say they are very confident in recognising a suspicious email, message or link (50 per cent are fairly confident), but only 13 per cent are equally confident when faced with a fake video generated by artificial intelligence. In general, however, Italians rate their own level of knowledge regarding risks and prevention positively, with 16 per cent describing it as very good and 65 per cent as fairly good (the EU average stands at 17 per cent and 60 per cent respectively). Over the last 12 months, 66 per cent of Italian respondents have taken part in a training programme (compulsory for 42 per cent and voluntary for 24 per cent), compared with an EU average of 60 per cent.
English version by the Translation Service of Withub
