Three in four employees in the European Union have come across suspicious emails, messages or links at work, according to a new Eurobarometer survey.
Phishing — fraudulent messages or websites designed to steal data or gain unauthorised access — was the most commonly reported workplace cyber threat, cited by 39% of employees, the European Commission informed on Wednesday.
Employees also reported attempts to steal personal data (18%) and passwords (16%), as well as malware attacks (17%) and artificial intelligence-generated scams (15%).
Most respondents said they understood the stakes, with 83% describing the potential consequences of cyberattacks as serious.
However, 48% said they could recognise an AI-generated fake video, and only 18% said their organisation had experienced no cyber incident at all, as far as they were aware.
Awareness does not always translate into habits
Among employees using digital systems and tools at work, 76% said clicking on a link without checking the sender is risky, while 74% said using the same password for private and work accounts is risky, according to the Commission.
Despite that, 54% said they check the sender before opening links, and 50% said they always lock their computer when leaving their workstation.
Six in ten employees (60%) said they had received cybersecurity training in the previous year, although participation dropped sharply in smaller organisations.
A total of 85% said they were interested in improving their cybersecurity skills, with lack of time cited as the main barrier by 26%.
The survey — Flash Eurobarometer 576 on ‘Cybersecurity at the workplace: awareness and preparedness among employees’ — was conducted online between 27 April and 8 May 2026 among 25,747 EU citizens across all 27 member states, with questions covering incidents in the previous six months.
