We are living in an era dominated by digital connectivity. You can’t overstate the importance of cybersecurity. As technology advances, so do the threats that lurk in the online world. Often, it’s our own actions that leave us most at risk of a cyberattack or online scam. Risky behaviors include weak passwords and lax security policies. As well as thinking “This won’t happen to me.” This is why human error is the cause of approximately 88% of data breaches. The National Cybersecurity Alliance and CybSafe are working to correct poor cyber hygiene. Each year, the duo publishes a report on cybersecurity attitudes and behaviours, with the goal of educating both people and businesses on how to better secure their digital landscapes.
Eye-Opening Insights from the 2025–2026 Annual Cybersecurity Attitudes and Behaviors Report
Each year, the National Cybersecurity Alliance and CybSafe survey thousands of people across multiple countries about how they actually behave online — not just what they say they’d do. The latest edition, released in late 2025, is the first to include Australian respondents directly, and it’s the first to dig seriously into AI risk. The numbers have moved a long way since we last covered this.
Cybercrime Is Up, Sharply
44% of respondents experienced cybercrime that caused data or financial loss in the past year — the highest level recorded in the report’s five-year history, and a 9-point jump on the previous edition. Younger generations are bearing the brunt of it: 59% of Gen Z and 56% of Millennials reported losses, compared to far lower rates among Baby Boomers.
The Training Gap Hasn’t Closed
55% of people still have no access to cybersecurity training at all — and even among those who do, only 32% actually use it. That’s a real gap, because training clearly works when people get it: those with access report meaningfully better outcomes, including 47% who say it improved their ability to spot phishing attempts, 42% who adopted multi-factor authentication as a result, and 40% who started using stronger passwords.
Security Habits: Some Progress, Some Backsliding
The behavioural picture is mixed. 77% of people are now aware of multi-factor authentication, but only 41% actually use it regularly — a wide gap between knowing and doing. Password habits went backwards slightly: 62% regularly create unique passwords, described in the report as a decline on the prior year, and 41% still never use a password manager. On the more positive side, 56% update their software frequently, 47% consistently back up important data, and 66% say they’re confident identifying malicious emails or links.
New This Year: AI Is the Blind Spot
This is the section the 2023 report couldn’t have written, because mainstream workplace AI use has exploded since then. 65% of people now use AI tools — up from 44% just a year earlier — led by ChatGPT (77% adoption among AI users), Gemini (49%), and Copilot (26%). The concerning part: 58% of those AI users received no security or privacy training on how to use these tools safely.
That gap shows up directly in behaviour. 43% of AI users admitted sharing sensitive workplace information with an AI tool without their employer’s knowledge — including internal company documents (50% of that group), financial data (42%), and client data (44%). People are also uneasy about where this is heading: 63% are concerned about AI-enabled cybercrime, 65% think AI makes impersonation easier, and 67% worry AI is blurring the line between real and fake information.
What This Means for Your Business
The AI-oversharing figures are the ones worth sitting with. If nearly half of employees using AI tools are willing to paste in client data or financial information without checking whether that’s allowed, that’s not a training problem for individuals to solve on their own — it’s a policy and governance gap. Clear guardrails on what can and can’t go into an AI tool, paired with the kind of security awareness training the report shows actually moves the needle, are no longer optional extras for businesses handling sensitive data.
Online Security Best Practices to Reduce Your Cybersecurity Risk
1. Strong, Unique Passwords:
- Start with the basics. Create strong, unique passwords for each online account using uppercase and lowercase letters, numbers, and special characters.
2. Multi-Factor Authentication (MFA):
- Enhance your account security with multi-factor authentication (MFA). MFA adds an extra barrier to unauthorized access, even for compromised passwords. You should activate the MFA option on every application you log into.
- If the application doesn’t have MFA, it would be wise to reassess what other security features they have or your use of that application.
3. Regular Software Updates:
- Keep all your software, including operating systems and mobile apps, up to date to avoid ransomware and phishing attacks.
4. Beware of Phishing Attacks:
- Exercise caution when clicking on links or opening attachments, especially in emails from unknown sources.
- Verify the legitimacy of emails and websites. You can check for subtle signs like misspelled URLs or unfamiliar sender addresses.
5. Use Secure Wi-Fi Networks:
- Ensure you connect to a secure and password-protected Wi-Fi network. Avoid using public Wi-Fi for sensitive transactions unless using a virtual private network (VPN).
6. Data Backup:
- Regularly back up important data to an external device or a secure cloud service.
7. Use Antivirus and Anti-Malware Software:
- Install reputable antivirus and anti-malware software on all devices and regularly scan your systems for potential threats.
8. Be Mindful of Social Media Settings:
- Review and adjust your privacy settings on social media platforms. Limit the amount of personal information visible to the public.
9. Secure Your Personal Devices:
- Lock your devices with strong passwords or biometric authentication such as FaceID or fingerprint access.
10. Educate and Stay Informed:
- Educate yourself and your team through cybersecurity awareness programs. This will help foster a culture of vigilance and preparedness.
Schedule Cybersecurity Awareness Training Today
A little education on cybersecurity goes a long way toward protecting your data. Contact us today to schedule a chat!
