EU Survey Finds 74% of Employees Encounter Suspicious Messages at Work
Summary
An EU survey found widespread employee exposure to suspicious messages and strong interest in cybersecurity training, while identifying time, cost and employer support as barriers. ENISA also highlights threats from its latest landscape report and workplace learning and
Key points
- 74% of surveyed employees said they had received suspicious emails, texts, voice messages or links; only 18% reported no incident in their organisation.
- 39% reported phishing or fraudulent emails, and 18% reported attempts to steal personal data; other reported threats included malware, password theft, AI-generated scams and ransomware.
- 83% believed a cyberattack would have serious consequences for their organisation, while 82% considered its digital systems and tools effective against attacks.
- Only 45% said their organisation regularly provides cybersecurity information or awareness updates; around half have key cybersecurity measures in place, and a quarter plan to adopt them.
- 85% of surveyed employees were interested in improving their cybersecurity skills. Reported barriers included lack of time (26%), training costs (16%), insufficient information and limited employer support.
- ENISA points organisations to its Awareness Raising-in-a-Box, cybersecurity skills framework, CyberHEAD education database, school-focused Cyber Education Tool, and training and exercises.
- ENISA’s threat-landscape figures include ransomware deployment in 40% of analysed financially motivated events and AI-enabled foreign information manipulation campaigns rising from 41 to 147 in a year.
Article Details
- Publisher
- ENISA
- Report Period
- The survey refers to the six months before it was conducted; exact dates are not stated. The threat landscape report's reporting period is not specified.
- Scope
- Employee cybersecurity awareness, exposure, preparedness, and training across the EU; also references ENISA's threat landscape across economic sectors.
- Sample Size
- Not disclosed for the employee survey. The threat landscape report analyzed more than 8,000 events.
- Key Statistics
- 74% of employees said they had received suspicious emails, text or vocal messages, or links.
- 39% reported receiving phishing or fraudulent emails; 18% reported attempts to steal personal data.
- 83% considered the consequences of a cyberattack serious for their organisation, while 82% rated its digital systems and tools effective against cyberattacks.
- 85% of employees surveyed were interested in improving their skills; reported obstacles included finding time (26%) and expense (16%).
- The threat landscape analysis covered more than 8,000 events; 73% of targeted organisations were essential or important entities under NIS2.
- Recommendations
- Improve workforce cybersecurity awareness and preparedness through upskilling.
- Use awareness activities and training to help employees identify and report suspicious activity.
- Organisations can use ENISA's Awareness Raising-in-a-Box to design and implement cybersecurity awareness programmes.
Products
AR-in-a-BoxAR-in-a-Box is a comprehensive solution for cybersecurity awareness activities designed to meet the needs of public bodies, operators of essential services, and both large and small private companies.Cyber Education ToolThe Cyber Education ToolCybersecurity Higher Education Database (CyberHEAD)The Cybersecurity Higher Education Database (CyberHEAD)European Cybersecurity Challenge (ECSC)The European Cybersecurity Challenge (ECSC) is an annual competition that brings together young cybersecurity talents from across Europe to compete and showcase their skills will be held in Bochum, Germany from 12-16European Cybersecurity Skills Framework (ECSF)The European Cybersecurity Skills Framework (ECSF)
Industries
business servicesOther targeted sectors include business services (8%), transport (8%), manufacturing (7%) and finance/ banking (6%).financeOther targeted sectors include business services (8%), transport (8%), manufacturing (7%) and finance/ banking (6%).ManufacturingOther targeted sectors include business services (8%), transport (8%), manufacturing (7%) and finance/ banking (6%).Public administrationThe most targeted sector remains public administration in 32% of cases.TransportOther targeted sectors include business services (8%), transport (8%), manufacturing (7%) and finance/ banking (6%).