The question, exactly as 2,719 people saw it
After denying a multi-factor authentication prompt you did not initiate, what should you do next to secure the account?
Change the password for that account correct52% Contact the IT support of the concerned website16% Nothing further is needed16% The full spread of answers, not just right and wrong. 16% chose "I don't know", which is a different group from the people who confidently picked a wrong answer: one needs teaching, the other needs correcting. Everyone answered in their own language; the English wording is shown here.
What a participant was told
The feedback shown after answering, verbatim:
Denying the prompt blocks that one attempt, but the password is still in someone else's hands. Changing it stops further attempts and secures the account.
The workgroup wrote these. Showing them beside the national result is how the questionnaire stays theirs.
Where it is weakest
Share who got it wrong, by group. Only groups with enough people and enough organisations appear.
| Group | Answer wrong | People |
|---|
| Healthcare sector | 54% | 221 |
| Financial services sector | 53% | 354 |
| Technology sector | 51% | 355 |
| 250 or more size | 51% | 1,204 |
| Insurance sector | 50% | 200 |
| Education sector | 50% | 326 |
| Belgium, everyone | 48% | 2,719 |
| 10 to 49 size | 48% | 659 |
| Professional services sector | 47% | 389 |
| Public sector sector | 43% | 92 |
| Manufacturing sector | 42% | 319 |
| Other sector | 42% | 237 |
| 50 to 249 size | 42% | 803 |
| 2 to 9 size | 41% | 34 |
| Retail sector | 38% | 226 |
1 group held back: Just me. They are named rather than left out, so you can tell the difference between still gathering and never measured.
