Each year, cyber threats become more advanced.
But, as survey data from the National Cybersecurity Alliance (NCA) shows, people’s cybersecurity vigilance is weakening.
Many people believe that their information is already compromised or that staying secure is an overwhelming task. Others feel they’re uninformed and unable to spot threats online. At work, many employees feel that they’re not the ones who are responsible for cybersecurity. That burden lies with their employers, they say.
However, with the growing prevalence of phishing and deepfakes, now is not the time to abandon online security efforts. This article describes the results of the NCA survey, highlighting the most critical habits of individuals and the sectors where cybersecurity awareness is most needed.
1. Cybersecurity is a low priority
- More than one-in-three people say they don’t see the point of protecting themselves since their information is already online
- More than half of people believe it’s expensive to fully protect themselves online
- 40% of people believe that having personal details stolen on the internet is unavoidable
- Half of people think their devices are automatically secure
Nearly one-quarter of people question whether it’s possible to stay secure online. As might be expected, this number is highest among older generations. For example, nearly 40% of the Silent Generation and nearly 30% of Baby Boomers don’t agree that it’s possible to stay secure online.
Overall, 58% of people say it’s easy to be secure online. However, there is a large portion of people who say staying safe is difficult: 45% say the information they read about online security is too confusing, and 43% say they’re often overwhelmed by the information they see.
When asked if online security measures are worth the effort, more than 20% of people are either neutral or disagree.
2. Limited access to cybersecurity training
- Just 32% of people have access to cybersecurity training
- 13% of individuals have access to training but don’t use it
- 83% of people who attended a cybersecurity training found it useful in some way
- More than half of people don’t have access to training or education to keep them secure online
Cybersecurity training is most prevalent in high-risk sectors. For example, 64% of IT workers reported having access to training and using it, and in the utilities industry, 60% of workers reported access to training.
In the finance sector, 58% of employees received training. However, the data shows that 15% of finance employees say they don’t use their training. Both of these statistics suggest that enterprises can do more to prevent the top cybersecurity risks in the financial sector.
Half of the people working for nonprofits and charities, which hold sensitive data about donors, reported having access to training. While this number is encouraging, it potentially means that half of nonprofit organizations are not properly training their employees. More information about these specific cybersecurity measures and threats can be found in our Cybersecurity Guide for Nonprofits.
3. Declining confidence in recognizing phishing
- 66% of people feel confident in their ability to spot a phishing email or malicious link, a one percent drop from last year
- Millennials’ level of confidence dropped by four percentage points from last year, and Gen Z’s dropped by three percentage points
- 10% of people rarely or never check messages for signs of phishing
Although some individuals believe they might be easily fooled by phishing emails, more than 60% of people always or very often check for signs of phishing before clicking on any links or responding to messages. But that is a four-point drop from last year.
Most people (55%) check the sender’s address, and more than half (54%) are tipped off when an email asks for personal information. More than half of people (53%) also look for poor spelling and grammar errors.
But the number of people reporting phishing messages is also decreasing. This year, 45% of people said that they always or very often use something like a “spam” or “report phishing” button, a two-point drop from last year. Nearly 30% of people rarely or never take this step.
4. Split opinions on cybersecurity ownership
- 35% of people say they rely on others to keep them secure online
- Among those who say they rely on others, 45% lean on family and 26% lean on IT companies
- 58% of people think they are the most responsible for protecting their personal information online
- 42% say the app or platform they are using is most responsible, 29% say it’s their internet service provider, and 24% say it’s the government
Older generations are increasingly turning to younger generations for cybersecurity coaching. This year, 58% of Millennials and 54% of Gen Zers said that others rely on them for online security assistance. Between these two groups, there was a seven percent increase over last year.
However, the majority of people across all generations (64%) expressed a lack of confidence in online security protections from law enforcement. That includes 71% of Baby Boomers and 65% of Gen Xers who view law enforcement as ineffective against cyber crimes.
5. Security responsibilities stay with the company
- Only one-third of people think they are most responsible for protecting their workplace’s data
- 45% of people say their company’s IT department is most responsible for protecting workplace information
- 40% of people say their company’s security department is most responsible
Considering that the average cost of a data breach now sits at $4.4 million, the limited responsibility that employees feel toward company cybersecurity is startling. This is especially concerning for those working in industries that are most frequently attacked, like healthcare, finance, and energy sectors.
Having threat experts on staff, like security analysts, or hiring outside experts, like security consultants, provides essential protection when employees’ security awareness is lacking. These experts can conduct assessments to uncover the most risky employee behaviors and recommend training programs to build a security-first culture.