These figures include demonstration data.

Cyber Behaviour Benchmark

Belgium. This is the live view: it changes as people complete the scan, so it is not for quoting.

Public sector

62
out of 100 · Patchy
5 organisations · 92 responses

The three things the scan measures

What people see
56
What people do
67
What people know
60
Belgium: 56 / 65 / 53, in the same order.

Against Belgium, by topic

Strongest topicPhishing 6 above the national line
Weakest topicPhone security 2 above the national line

Where public sector organisations sit

held back No figure is shown for this group. One appears once at least 5 organisations have taken part, with at least 20 people between them.

Public sector by size

The same group, split by how many people the organisation employs.
Just me
–
2 to 9
–
10 to 49
–
50 to 249
–
250 or more
–
Held back, each needing at least 5 organisations and 20 people: Just me (1 organisation, needs 5), 2 to 9 (nobody yet), 10 to 49 (2 organisations, needs 5), 50 to 249 (1 organisation, needs 5), 250 or more (1 organisation, needs 5).
Anything held back on the front page stays held back here.

Every question, for Public sector

Share of people whose own answer puts them at risk, or who got the knowledge question wrong. Lower is better in both columns. Each question opens its own page.
QuestionHereBelgiumDifference
Confidential information left in the open11%7%4 worse
A colleague's unlocked screen12%6%6 worse
A password written down11%8%3 worse
Confidential files sent unprotected8%7%1 worse
Company information on social media13%7%6 worse
Work sent from a private account9%8%1 worse
Checking links before clicking11%14%3 better
Reporting suspicious messages9%14%5 better
Multi-factor authentication8%10%2 better
Password reuse8%13%5 better
Anonymising before using AI tools10%14%4 better
Working from a public place14%17%3 better
Forwarding work files to a personal account10%7%3 worse
Family or friends using a work device5%6%1 better
Trusted app stores5%12%7 better
Challenging an unknown visitor–14%Below the publication rules.
Backing up critical data9%16%7 better
Reviewing who has access9%14%5 better
Sharing files the approved way9%14%5 better
Checking AI answers5%13%8 better
Phone number spoofing27%39%12 better
Phishing from real accounts37%40%3 better
Reading a link52%58%6 better
Spotting the real domain43%53%10 better
A computer that may be infected48%54%6 better
What HTTPS does41%47%6 better
AI chat history29%39%10 better
Internal or confidential46%55%9 better
An unexpected MFA prompt29%40%11 better
After denying a prompt43%48%5 better
Get a report of your own, and for organisations in Belgium see how yours compares on this. Free, about six minutes per person.See where you stand