These figures include demonstration data.

Cyber Behaviour Benchmark

Belgium. This is the live view: it changes as people complete the scan, so it is not for quoting.

The question, exactly as 3,832 people saw it

True or false: phishing emails can be sent from real, legitimate email accounts that have been hacked.
True correct
56%
False, phishing always comes from untrusted email addresses
22%
I don't know
22%
The full spread of answers, not just right and wrong. 22% chose "I don't know", which is a different group from the people who confidently picked a wrong answer: one needs teaching, the other needs correcting. Everyone answered in their own language; the English wording is shown here.

What a participant was told

The feedback shown after answering, verbatim:
Phishing is sometimes sent from genuine accounts that have been compromised through stolen passwords or malware. Because the message arrives from a real, trusted address, it can pass technical controls, which makes this type of attack particularly hard to spot.
The workgroup wrote these. Showing them beside the national result is how the questionnaire stays theirs.

Where it is weakest

Share who got it wrong, by group. Only groups with enough people and enough organisations appear.
GroupAnswer wrongPeople
Education sector50%329
Healthcare sector49%402
Other sector48%352
2 to 9 size47%55
10 to 49 size46%608
Professional services sector45%486
Technology sector45%428
Belgium, everyone44%3,832
Public sector sector44%192
50 to 249 size44%1,251
Insurance sector43%416
250 or more size43%1,886
Manufacturing sector41%488
Retail sector39%410
Financial services sector37%329
Just me size37%32
Get a report of your own, and for organisations in Belgium see how yours compares on this. Free, about six minutes per person.See where you stand