These figures include demonstration data.

Cyber Behaviour Benchmark

Belgium. This is the live view: it changes as people complete the scan, so it is not for quoting.

The question, exactly as 2,719 people saw it

True or false: phishing emails can be sent from real, legitimate email accounts that have been hacked.
True correct
60%
False, phishing always comes from untrusted email addresses
21%
I don't know
19%
The full spread of answers, not just right and wrong. 19% chose "I don't know", which is a different group from the people who confidently picked a wrong answer: one needs teaching, the other needs correcting. Everyone answered in their own language; the English wording is shown here.

What a participant was told

The feedback shown after answering, verbatim:
Phishing is sometimes sent from genuine accounts that have been compromised through stolen passwords or malware. Because the message arrives from a real, trusted address, it can pass technical controls, which makes this type of attack particularly hard to spot.
The workgroup wrote these. Showing them beside the national result is how the questionnaire stays theirs.

Where it is weakest

Share who got it wrong, by group. Only groups with enough people and enough organisations appear.
GroupAnswer wrongPeople
Healthcare sector52%221
250 or more size46%1,204
Technology sector45%355
Financial services sector44%354
Education sector41%326
Belgium, everyone40%2,719
Insurance sector39%200
Professional services sector38%389
Manufacturing sector37%319
Public sector sector37%92
Other sector37%237
10 to 49 size37%659
50 to 249 size35%803
Retail sector31%226
2 to 9 size26%34
1 group held back: Just me. They are named rather than left out, so you can tell the difference between still gathering and never measured.
Get a report of your own, and for organisations in Belgium see how yours compares on this. Free, about six minutes per person.See where you stand