Cyber Threats Are Routine at Work Across the EU, but Preparedness Remains Patchy

Three in four EU employees encountered suspicious emails, messages or links at work, according to a new Eurobarometer survey, with phishing emerging as the most common threat and daily cyber hygiene still falling short.

Cybersecurity has become an everyday workplace exposure across the European Union rather than an occasional technical disruption. Three in four employees encountered suspicious emails, messages or links at work, while phishing emerged as the most common threat, affecting 39% of workers surveyed across all 27 EU Member States, according to a new Eurobarometer survey published by the European Commission.

What stands out is not simply the scale of attempted attacks, but the mismatch between what employees understand and what they consistently do. Most workers recognise basic cyber risks, yet far fewer routinely check senders, secure their devices or translate that knowledge into habits strong enough to withstand increasingly varied forms of digital deception.

The weakest point is often the moment before the click

Workplace cybersecurity is frequently discussed in terms of firewalls, software, network protection and regulatory compliance. The survey results bring attention to a less technical but equally consequential layer: the few seconds in which an employee decides whether to trust a message, open a link or disclose information.

Awareness is comparatively high:

• Seventy-six per cent of employees using digital systems recognise the danger of clicking a link without checking who sent it
• 74% understand the risk of reusing passwords across private and work accounts
• Sixty-nine per cent also recognise that sharing work-related information on social media can create security problems.

Daily behaviour is considerably less disciplined. Only 54% say they check the sender before opening links, and just half consistently lock their computers when stepping away from their workstation. The gap suggests that cybersecurity knowledge is reaching employees more effectively than cybersecurity routines are becoming embedded in working life.

Phishing exploits precisely this gap. An employee does not need to be unaware of the risk for an attack to succeed; distraction, haste, familiarity or misplaced trust can be enough. So, a workforce can score relatively well on awareness while remaining vulnerable at the point where recognition must become action.

Familiar threats are being joined by synthetic deception

Phishing remains the dominant reported threat, but the workplace risk environment is becoming more complicated. Employees also reported attempts to steal personal data and passwords, malware attacks and scams generated using artificial intelligence, widening the range of signals workers are expected to interpret correctly.

AI-generated scams were encountered by 15% of employees, while fewer than half said they could recognise an AI-generated fake video. The figures do not indicate how many such attempts succeeded, but they expose a practical difficulty for organisations whose security training has traditionally focused on suspicious links, unusual attachments and obvious impersonation attempts.

Synthetic media can complicate established trust cues. Workers may increasingly have to judge not only whether an email looks authentic, but whether an image, video or other piece of digital content is genuine. Cyber awareness built around yesterday's warning signs may provide only partial protection when fraudulent material becomes more convincing.

Older forms of attack are not disappearing as newer ones emerge. Employees are facing conventional phishing alongside malware, credential theft, data-harvesting attempts and AI-enabled fraud. Workplace defence is consequently becoming less about teaching a single set of warnings and more about maintaining scepticism across several communication formats.

Training demand is high, but coverage remains uneven

Organisations are not starting from a position of employee indifference. Eighty-five per cent of workers say they are interested in improving their cybersecurity skills, creating a substantial base of willingness for employers trying to strengthen internal protection.

Access to training is less universal. Sixty per cent of employees received cybersecurity training during the previous year, with participation falling sharply in smaller organisations. Lack of time is the most commonly cited barrier to improving skills, reported by 26%, highlighting a familiar workplace problem: security is considered important, but training still competes with operational priorities.

Organisation size may become an increasingly important fault line. Smaller employers typically have fewer employees over whom risk must be managed, but lower participation in cybersecurity training means individual mistakes can still carry significant consequences.

Employee confidence in organisational protection also requires careful interpretation. Most workers believe their organisations are effective at defending against cyberattacks, yet only around half report that key cybersecurity measures are already in place, with another quarter saying their organisations plan to introduce them. Perceived protection and operational preparedness are not necessarily the same thing.

Europe's cyber resilience will be tested in ordinary workplaces

Age introduces another important divide. Cyber-risk awareness and basic security habits increase strongly among older workers, while employees aged 15 to 24 stand out as a group for whom more targeted training may be required.

Greater familiarity with digital technology should not automatically be treated as equivalent to stronger security behaviour. Younger employees may be highly comfortable with digital tools while still being less consistent in practices such as password separation, sender verification or other forms of routine cyber hygiene.

For employers, this complicates the design of cybersecurity programmes. A single annual training session delivered uniformly across the workforce may not address differences in behaviour, experience or risk exposure. Training becomes more useful when it targets the specific decisions employees make during ordinary work rather than merely testing whether they can identify abstract security principles.

The challenge is becoming more pressing as cybersecurity rules extend across critical sectors, connected products and digital services in the European Union. Regulation can strengthen organisational requirements, but compliance frameworks cannot make every decision for workers operating inboxes, messaging platforms and digital systems throughout the day.

Europe's workplace cyber challenge is increasingly concentrated in this space between institutional protection and individual behaviour. Employees broadly understand that cyberattacks can have serious consequences, yet inconsistent habits leave openings that technical safeguards and awareness campaigns cannot fully close.

The next measure of progress will not be whether more workers have heard of phishing or understand that weak passwords are risky. It will be whether checking senders, securing workstations, separating credentials and questioning suspicious digital content become routine enough to survive the pressures of everyday work.