These figures include demonstration data.

Cyber Behaviour Benchmark

Belgium. This is the live view: it changes as people complete the scan, so it is not for quoting.

Retail

64
out of 100 · Patchy
16 organisations · 226 responses

The three things the scan measures

What people see
63
What people do
68
What people know
61
Belgium: 56 / 65 / 53, in the same order.

Against Belgium, by topic

Strongest topicInternet surfing 10 above the national line
Weakest topicPhone security 3 above the national line

Where retail organisations sit

The 12 organisations of the 16 here where at least 5 people have finished, so they have a score of their own.
Exposed, 0-49. Safe habits are the exception rather than the rule. What protects this organisation is mostly its technology, not what its people do day to day.
Patchy, 50-69. Good habits exist but they are uneven: strong in some people and some topics, absent in others. A Patchy organisation is not careless, it is unmanaged.
Aware, 70-84. Safe habits are normal for most people most of the time, and the remaining gaps are specific rather than general.
Resilient, 85-100. Safe habits hold up under pressure, including among people who are busy, new, or being rushed by someone else.
Held back. Where fewer than 5 organisations sit in a band we do not give the number, because it would point at particular employers. Those bands are shown together as one segment.

Retail by size

The same group, split by how many people the organisation employs.
Just me
–
2 to 9
–
10 to 49
63
50 to 249
–
250 or more
–
Held back, each needing at least 5 organisations and 20 people: Just me (2 organisations, needs 5), 2 to 9 (2 organisations, needs 5), 50 to 249 (2 organisations, needs 5), 250 or more (1 organisation, needs 5).
Anything held back on the front page stays held back here.

Every question, for Retail

Share of people whose own answer puts them at risk, or who got the knowledge question wrong. Lower is better in both columns. Each question opens its own page.
QuestionHereBelgiumDifference
Confidential information left in the open9%7%2 worse
A colleague's unlocked screen8%6%2 worse
A password written down7%8%1 better
Confidential files sent unprotected6%7%1 better
Company information on social media9%7%2 worse
Work sent from a private account9%8%1 worse
Checking links before clicking12%14%2 better
Reporting suspicious messages12%14%2 better
Multi-factor authentication14%10%4 worse
Password reuse11%13%2 better
Anonymising before using AI tools18%14%4 worse
Working from a public place12%17%5 better
Forwarding work files to a personal account7%7%0 level
Family or friends using a work device8%6%2 worse
Trusted app stores11%12%1 better
Challenging an unknown visitor14%14%0 level
Backing up critical data12%16%4 better
Reviewing who has access9%14%5 better
Sharing files the approved way11%14%3 better
Checking AI answers11%13%2 better
Phone number spoofing34%39%5 better
Phishing from real accounts31%40%9 better
Reading a link49%58%9 better
Spotting the real domain43%53%10 better
A computer that may be infected43%54%11 better
What HTTPS does38%47%9 better
AI chat history37%39%2 better
Internal or confidential46%55%9 better
An unexpected MFA prompt35%40%5 better
After denying a prompt38%48%10 better
Get a report of your own, and for organisations in Belgium see how yours compares on this. Free, about six minutes per person.See where you stand