Three in Four EU Employees Saw a Cyber Threat at Work. That Isn’t a Breach Rate.

Most employees do not encounter cyber risk as a dramatic incident. They see an odd email, a link that feels out of place, an unexpected password prompt or a request that does not quite match the normal process. Whether they report it may depend less on technical knowledge than on whether the organization has made reporting easy, safe and useful.

A European Commission Eurobarometer release published on September 30, 2026 says three in four surveyed EU employees had encountered suspicious emails, messages or links at work in the previous six months. The release also reports that 39% encountered phishing, 18% attempts to steal personal data, 16% attempts to steal passwords, 17% malware and 15% AI-generated scams. These are self-reported experiences in a survey; they are not verified incident counts, and people may have encountered more than one type of threat.

The distinction matters. “I saw a suspicious message” does not mean “my device was infected,” just as “I did not notice one” does not prove that no attack occurred. The results are best read as a measure of how often employees believe they are seeing warning signs and how prepared they feel—not as a scoreboard of successful compromises.

What the survey tells us—and what it cannot

Reported finding	Useful interpretation	Do not infer
Three in four encountered a suspicious message, email or link	Suspicious contact is an ordinary part of work life for many respondents.	That three in four organizations suffered a breach or that three in four employees clicked.
39% reported encountering phishing	People recognize or describe a meaningful volume of contact as phishing.	A confirmed attack rate; the survey relies on respondents’ own recognition and recall.
15% reported AI-generated scams	AI is now part of how some employees understand suspicious contact.	That every case used generative AI or that people can reliably identify synthetic media.
45% said their organization sends regular cybersecurity awareness updates	Many respondents do not recall regular communication from their employer.	That no training exists; respondents may not remember it or may interpret “regular” differently.

Those caveats are not a reason to dismiss the survey. They are a reason to ask a more useful question: what organizational conditions help people act on an uncertain signal? A company may send annual training and still make reporting so inconvenient that employees keep quiet. Another may communicate less often but have a visible one-click report option and a fast, respectful response.

The reporting gap is a design problem

The European Commission says 83% of respondents considered the consequences of cyber threats serious, while 85% were interested in improving their cybersecurity skills. Yet only 45% said their organization provides regular updates about cybersecurity awareness, and 48% felt confident recognizing an AI-generated fake video. Together, those responses suggest an audience that sees the stakes and wants help, but does not necessarily feel equipped or regularly supported.

Training should not make the employee the organization’s only sensor. People are asked to judge whether a sender is genuine, whether a link is safe, whether a voice is familiar and whether a request is normal—all while doing their actual job. A more resilient workplace gives people a simple path to ask for help before they click and a sensible path after a mistake.

Reporting also has a social cost. Someone may worry that a false alarm will look foolish, that they will be blamed for clicking, or that a security team will respond with a lecture instead of help. If an organization wants early reports, it has to show what happens next: a human acknowledgement, quick containment when needed, and a short explanation of what was learned.

Build a small, dependable reporting loop

1. Put the route where work happens. Make the report button visible in email and chat, and provide an equivalent route for phone calls, QR codes or documents. Employees should not have to remember a mailbox name from a training slide.
2. Tell people what to include. Ask for the original message or a safe report of the sender, time and action taken. Do not ask employees to forward sensitive data to a public or unmonitored inbox.
3. Respond quickly, even when the message is benign. A short “thanks, we checked it” closes the loop. If follow-up is needed, tell the reporter what to do and when they will hear back.
4. Separate learning from blame. If someone clicked or shared a code, the first priority is to secure the account and device. Review process gaps later, without shaming the person who raised their hand.
5. Use trends carefully. Aggregate reports can reveal recurring pretexts or confusing workflows, but a high number of employee reports can mean the reporting system is working—not that the workforce is failing.

AI confidence is not the same as verification

Nearly half of respondents said they felt confident recognizing an AI-generated fake video. Confidence is worth noting, but it is not a test result. People may overestimate their ability to identify synthetic voice or video, and authentic media can be edited or taken out of context. Conversely, a low-quality or unusual call is not automatically fake.

For high-impact requests—changing a supplier’s bank details, sharing confidential material, resetting access or sending money—use a second channel that is already known. Call a saved number, confirm in the established company system or ask another authorized person. Do not use the phone number or link that came with the request. The point is not to determine whether an image is synthetic; it is to verify the action with the right person.

Our report on new deepfake warnings in video meetings makes a related point: an on-screen warning can signal uncertainty, but it cannot tell an employee whether the requested payment or account change is authorized. Process beats visual confidence.

Measure whether the system helps, not whether people pass a quiz

Organizations can track practical measures: how long it takes to acknowledge a report, whether reporters know where to send it, how often a request is verified through a second channel, and whether employees can recover after an accidental click. Those indicators are more actionable than asking whether people can define phishing.

Leaders should also distinguish exposure from outcome. A rise in reported suspicious messages may reflect a real increase in attempts, better awareness, a simpler reporting channel or all three. It should prompt investigation, not an automatic conclusion that employees are careless. The same care applies to a decline: fewer reports could mean fewer suspicious messages, but it could also mean people have stopped reporting.

The survey is a snapshot, not a verdict on Europe’s workforce. Its clearest message is that suspicious contact is common enough to design around, while many workers still want more support. A strong workplace response makes a pause normal, makes reporting low-friction and verifies consequential requests independently. That way, security does not depend on every person recognizing a perfect fake in the moment.

Sources

• European Commission, Eurobarometer: three in four EU employees encountered cyber threats at work, September 30, 2026.
• ENISA, Cybersecurity Month: work employees’ skills under the looking glass.
• Eurobarometer survey record 3681.