UK respondents lead on phishing checks but trail on reporting

The UK’s phishing results separate checking from reporting

The UK’s strongest result in CybSafe and the National Cybersecurity Alliance’s five-country cyber behaviour survey sits beside its weakest: 68% of UK respondents said they checked messages for phishing signs very often or always, while 37% reported phishing that regularly. Phishing uses deceptive messages to trick people into sharing information or taking a harmful action. The checking rate led the surveyed markets; the reporting rate came last. For organisations assessing security awareness, this reversal shows why each action needs its own measure.

Checking means examining a message for signs of phishing; reporting means notifying someone or escalating the suspicious message for attention. A report gives an organisation a chance to investigate an attempt that may also reach other users and systems. Security teams therefore need to understand both how people examine messages and what helps them report a suspicious one.

Measure each security behaviour separately

The survey covered 5,000 people across the UK, US, India, Brazil and Singapore, with 1,000 respondents in each country. CybSafe has a commercial interest in organisations investing in security-behaviour measurement and support, which matters when weighing its interpretation and recommendations. Participants described their own habits, awareness, access to support and experiences. These population-level self-reports give business leaders questions to investigate in their own organisations.

The reversal is clear across the surveyed countries. Checking rates in the other four markets ranged from 56% to 61%, below the UK’s result, while their reporting rates ranged from 39% to 43%, above it. The UK’s performance therefore depended on which action was measured. A broad label such as “security-aware” would hide a distinction that matters when designing a reporting programme.

The survey’s UK figures leave a difference of 31 percentage points between the two reported frequencies. These are responses for the population as a whole: the people reporting frequent checking may differ from those reporting frequent escalation. Checking frequency measures how regularly people say they inspect messages, whereas detection accuracy concerns whether they correctly distinguish phishing from legitimate messages. A security team therefore has three behaviours to examine: checking, accurate identification and reporting.

Reporting frequency also reveals a group that needs attention: 24% of UK respondents said they rarely or never reported phishing. This category includes both infrequent reporters and people who say they never report. To investigate the pattern, organisations need to ask what people do with suspicious messages and what influences that choice. Their reasons matter because different obstacles may require different support.

Other security habits show why that investigation should focus on the specific action. British respondents were the least likely among the five markets to use personal information, such as pet names or birthdays, in passwords: 31% reported doing so, compared with 38% in the US and 50% in India. The UK sample thus showed comparatively careful password choices alongside its low reporting ranking. Strength in one habit can coexist with weakness in another.

The UK also led on regular use of multi-factor authentication, or MFA, which requires an additional check beyond a password when signing in. Regular use stood at 59%. Meanwhile, 62% said they regularly installed software updates, another leading result among the five surveyed markets. MFA protects account access; updates maintain software. Reporting brings a suspicious message to someone’s attention, so each action needs its own assessment of whether people can carry it out and get help when needed.

Investigate access to reporting and training

For some UK respondents, getting help starts with finding a reporting route: 10% said they did not know how to report a suspicious message or had never seen a way to do so. These combined answers raise two practical questions. Do people understand the procedure, and can they find an available method? Organisations need to examine both, because explaining a procedure and making its entry point visible address different problems.

Access to the guidance behind those procedures was also uneven. In the UK sample, 57% said they had no access to cyber security training, a proportion exceeded only by Brazil at 64%. Organisations expecting people to follow security guidance therefore need to establish who can get it. They can then assess whether that guidance helps people act.

Knowledge of authentication can vary even in a population with strong overall results. Alongside the UK’s leading rate of regular MFA use, 19% of respondents said they had never heard of MFA. These results describe people with different knowledge, practices and access to help. Examining those differences lets an organisation direct support towards the people who need it.

The reporting and training responses suggest a practical hypothesis to test locally: some people may recognise suspicious activity yet need clearer instructions, a visible reporting route or timely help. Organisations can investigate whether people who report infrequently have those needs and whether the same people lack training access. This ties a proposed intervention to a specific obstacle. Training then becomes one option to evaluate alongside changes to the reporting process.

Deepfake losses add urgency to support

Deepfakes are fabricated audio or video that imitates a real person, and the survey shows how costly they can be. In the UK sample, 22% said they had received a scam call or video call using fabricated audio or video; among respondents who had encountered that type of attack, 36% said they had lost money or data as a result. The loss figure applies to the exposed group. It adds a separate measure of harm alongside the phishing-reporting results.

Lisa Plaggemier, Executive Director of the National Cybersecurity Alliance, connected these findings to workplace AI use and wider scam exposure. The Alliance co-produced the survey, and her comments support its security-awareness work. “We‘re at a critical moment. AI is now part of how most people work, yet a large portion of workers are using it without their employer’s knowledge or guidance on what’s safe to share. At the same time scams are prominent, half of adults globally have already been victimized,” she said.

Plaggemier brings employer guidance into a discussion that also concerns individual security habits. People using AI at work decide what information to share, while those receiving messages and calls must decide whom to trust. When employees use AI without their employer’s knowledge or guidance, they need an accessible way to ask what is safe. The need for support therefore extends beyond the mechanics of reporting a suspicious message.

Test how reporting support changes behaviour

To evaluate such support, a security programme first needs to specify the action it aims to change. Dr Jason Nurse, Director of Science and Research at CybSafe and Reader in Cyber Security at the University of Kent, recommends measuring behaviours separately and testing the help people receive. His CybSafe role gives him a commercial stake in that approach. “The striking finding is the gap between checking and reporting. One good security habit does not tell us whether someone takes the next step. We need to measure behaviours directly, understand what gets in the way and test whether the support people receive makes a difference,” said Dr Nurse.

Nurse’s sequence turns the survey findings into an organisational investigation: establish the behaviour, identify obstacles, then evaluate support. Awareness measures can show what people know, while reporting measures show whether they act. Teams can examine whether people understand the procedure, can find the reporting route and can get help. Keeping those questions separate helps identify which part of the process needs attention.

Once obstacles are identified, Oz Alashe, Chief Executive Officer of CybSafe, proposes changes to the reporting process. As the company’s chief executive, he shares its commercial interest in investment in this kind of support. “The UK data shows people are already doing some of the right things. Organisations need to make it easier for them to take the next step. That means clear reporting routes, support when people need it and feedback that shows why reporting matters. Success is whether that support changes behaviour and reduces risk,” said Alashe.

Alashe’s recommendations address different moments in the process. A clear route helps someone find where to send a suspicious message; timely support helps them act when unsure; feedback explains the value of having reported it. Teams can evaluate each change against the obstacle it aims to address. Nurse and Alashe offer related recommendations from the same company, giving organisations an approach to test.

Plaggemier extends the requested actions to both suspicious messages and workplace AI guidance. “The ability to spot a scam is a great first step, but cybercriminals count on us stopping there. This Cybersecurity Awareness Month, we want to turn awareness into action – report that suspicious message, ask your employer about AI policies, and make secure habits part of your everyday routine,” she said. Those requests create corresponding responsibilities for employers: people need somewhere to report, someone to ask and guidance they can use during ordinary work.

Employers can assess those responsibilities by measuring the effects of a specific change. Before making a reporting route clearer, define how to assess whether people can find it and whether reporting frequency changes; before adding guidance, decide how to assess whether it helps people act. Any improvement also needs to be examined for its effect on risk. These measures give the organisation a basis for deciding whether the change earns continued investment.

Key executive takeaways

• Measure checking and reporting separately: UK respondents led the five surveyed countries on frequent phishing checks at 68% but ranked last on reporting at 37%. Security teams need distinct measures for each action to identify where support is needed.
• Validate findings within your organisation: The survey captures self-reported habits across national populations. Security teams need local evidence on checking, accurate identification and reporting before choosing interventions.
• Investigate access to reporting and training: Among UK respondents, 10% lacked reporting knowledge or visibility of a reporting route, while 57% lacked access to cyber security training. Employers need to establish whether employees can find the reporting process, understand it and get help.
• Assess support for deepfake scams: Among UK respondents who encountered fabricated audio or video scams, 36% reported losing money or data. Security teams need to examine how employees assess suspicious calls and where they seek help when unsure.
• Test whether reporting support changes behaviour: Clear reporting routes, timely help and feedback address different potential obstacles. Security programme owners need to define measures before introducing changes, then assess their effects on reporting behaviour and risk.