The question, exactly as 3,832 people saw it
After denying a multi-factor authentication prompt you did not initiate, what should you do next to secure the account?
Change the password for that account correct49% Contact the IT support of the concerned website17% Nothing further is needed17% The full spread of answers, not just right and wrong. 17% chose "I don't know", which is a different group from the people who confidently picked a wrong answer: one needs teaching, the other needs correcting. Everyone answered in their own language; the English wording is shown here.
What a participant was told
The feedback shown after answering, verbatim:
Denying the prompt blocks that one attempt, but the password is still in someone else's hands. Changing it stops further attempts and secures the account.
The workgroup wrote these. Showing them beside the national result is how the questionnaire stays theirs.
Where it is weakest
Share who got it wrong, by group. Only groups with enough people and enough organisations appear.
| Group | Answer wrong | People |
|---|
| Education sector | 55% | 329 |
| Professional services sector | 53% | 486 |
| Healthcare sector | 53% | 402 |
| Technology sector | 53% | 428 |
| Public sector sector | 53% | 192 |
| 2 to 9 size | 53% | 55 |
| 10 to 49 size | 52% | 608 |
| Belgium, everyone | 51% | 3,832 |
| Other sector | 51% | 352 |
| 250 or more size | 51% | 1,886 |
| Financial services sector | 50% | 329 |
| 50 to 249 size | 50% | 1,251 |
| Insurance sector | 47% | 416 |
| Manufacturing sector | 47% | 488 |
| Retail sector | 47% | 410 |
| Just me size | 34% | 32 |
