Three in four EU employees have faced cyber threats at work, new Eurobarometer survey finds

Three in four employees in the European Union have encountered suspicious emails, messages or links at work, according to a new Eurobarometer survey published today by the European Commission. The results were published as European Cybersecurity Month begins across all 27 Member States. Phishing was the most common workplace cyber threat, with 39% of employees reporting fraudulent messages or websites designed to steal data or gain unauthorised access. Employees also reported attempts to steal personal data (18%) and passwords (16%), malware attacks (17%) and AI-generated scams (15%). The findings point to a gap between awareness and daily practice. While 83% said the potential consequences of cyberattacks are serious, only 48% said they could recognise an AI-generated deepfake video. Overall, only 18% said their organisation had not suffered any cyber incident, as far as they knew. Awareness is high, but it doesn't always translate into daily habits Employees widely recognise risky behaviour, especially around phishing and password management. Among those using digital systems and tools at work, 76% said clicking a link without verifying the sender is risky, 74% said using the same password for private and work accounts is risky, and 69% said sharing work-related information on social media platforms is risky. Most employees also know they should report suspicious emails and install software updates. However, this awareness often fails to translate into daily practice. While 72% said they could identify suspicious emails, only around 54% said they check the sender before opening links, and just 50% said they always lock their computer when leaving their workstation. Basic cyber-hygiene habits, such as checking the sender before opening links and using strong passwords, are common but inconsistent across the workforce, and improve significantly with age -- highlighting the need for targeted training, particularly for younger employees aged 15 to 24. Organisations need more training and preparedness While most employees consider their organisation effective at protecting against cyberattacks, only about half of organisations have essential cybersecurity measures in place, and a further quarter plan to introduce them. Six in ten employees (60%) said they had received cybersecurity training in the past year, though participation drops sharply in smaller organisations. At the same time, 85% were interested in improving their cybersecurity skills, with lack of time cited as the main barrier (26%). These findings come as the EU rolls out cybersecurity rules across critical sectors, connected products and digital services.