What a participant was told
The feedback shown after answering, verbatim:
A link's true destination is its domain name. Attackers often place trusted or familiar words elsewhere in the link to appear legitimate, but only the domain says where the link really goes. To find it, locate the first single / and read the two dot-separated parts to its left: here that gives security.up, not “cyber” or “risk-cyber”. Everything before the domain is chosen by whoever set up the site.
The workgroup wrote these. Showing them beside the national result is how the questionnaire stays theirs.
Where it is weakest
Share who got it wrong, by group. Only groups with enough people and enough organisations appear.
| Group | Answer wrong | People |
|---|
| Education sector | 62% | 326 |
| Healthcare sector | 62% | 221 |
| Technology sector | 58% | 355 |
| 250 or more size | 56% | 1,204 |
| Financial services sector | 55% | 354 |
| Insurance sector | 55% | 200 |
| Belgium, everyone | 53% | 2,719 |
| 10 to 49 size | 53% | 659 |
| Professional services sector | 49% | 389 |
| Other sector | 49% | 237 |
| 50 to 249 size | 48% | 803 |
| Manufacturing sector | 44% | 319 |
| Retail sector | 43% | 226 |
| Public sector sector | 43% | 92 |
| 2 to 9 size | 41% | 34 |
1 group held back: Just me. They are named rather than left out, so you can tell the difference between still gathering and never measured.
