Spotting the real domain · Cyber Behaviour Benchmark

The question, exactly as 3,832 people saw it

Select the domain name (the “main website”) in this link:

cyber.security

14%

security.up correct

44%

up/risk

14%

risk-cyber

14%

I don't know how to read a link

14%

The full spread of answers, not just right and wrong. 14% chose "I don't know how to read a link", which is a different group from the people who confidently picked a wrong answer: one needs teaching, the other needs correcting. Everyone answered in their own language; the English wording is shown here.

What a participant was told

The feedback shown after answering, verbatim:

A link's true destination is its domain name. Attackers often place trusted or familiar words elsewhere in the link to appear legitimate, but only the domain says where the link really goes. To find it, locate the first single / and read the two dot-separated parts to its left: here that gives security.up, not “cyber” or “risk-cyber”. Everything before the domain is chosen by whoever set up the site.

The workgroup wrote these. Showing them beside the national result is how the questionnaire stays theirs.

Where it is weakest

Share who got it wrong, by group. Only groups with enough people and enough organisations appear.

Group	Answer wrong	People
Education sector	64%	329
Other sector	61%	352
Technology sector	60%	428
10 to 49 size	58%	608
50 to 249 size	58%	1,251
Healthcare sector	57%	402
Belgium, everyone	56%	3,832
Manufacturing sector	56%	488
Insurance sector	55%	416
2 to 9 size	55%	55
250 or more size	54%	1,886
Public sector sector	53%	192
Retail sector	52%	410
Financial services sector	50%	329
Professional services sector	50%	486
Just me size	41%	32

Get a report of your own, and for organisations in Belgium see how yours compares on this. Free, about six minutes per person.See where you stand