Monday 26 October 2026 | A 9-minute read
Every so often a week's research lines up and tells one story. This week it is this: people's intentions are mostly fine, and the path decides what actually happens. Attackers are moving to the channels we scrutinise least, employees are routing around the controls that slow them down, and the most encouraging news comes from designers quietly making the safe path the easy one. If you have ever argued that human risk is a design problem rather than a willpower problem, this is your week.
Willing, but unsupported: the Oh, Behave! 2026 report lands
The sixth annual Oh, Behave! report from the National Cybersecurity Alliance and CybSafe arrived on 22 October, drawing on a survey of 5,000 adults across the US, UK, India, Brazil and Singapore. The headline this year is less "people are the problem" and more "people are ready, and nobody has caught up with them". AI adoption illustrates it starkly: 80% of respondents now use AI, yet 56% of those users have had no security or privacy training on it at all. Among people using AI at work, 32% admit to sharing sensitive company information with an AI tool without their employer knowing, and 43% say their employer has never clearly explained what is acceptable to share.
The training findings are the quiet good news. Of those who received security training, 88% found it useful, 54% say they got better at spotting phishing afterwards, and 49% went on to set up multi-factor authentication. The catch: only 47% of employed respondents face any mandatory security training at all. Training works for the people who get it; most people don't.
What does this mean for me? Two things worth taking into Monday. First, if your organisation has rolled out AI tools faster than AI guidance, the 43% figure is your business case for a one-page acceptable-use message in plain language, this quarter, not next. Second, the 88% usefulness figure is a strong counter to "training fatigue" scepticism in budget conversations, with the usual caveat that this is self-reported survey data and CybSafe sells training. Even discounted for that, the gap between appetite and provision is the finding.
Source: National Cybersecurity Alliance, Oh, Behave! 2026 announcement
Brussels measures the gap between confidence and checking
The European Commission published a Eurobarometer survey on workplace cybersecurity at the end of September, and it deserves more attention than it has received. Eurobarometer is the Commission's long-running public opinion programme, so this is government survey research across the EU workforce rather than a vendor pitch. Three in four EU workers report encountering suspicious emails, messages or links at work. Phishing leads the threat list at 39%, ahead of personal data theft (18%), malware (17%) and password harvesting (16%), with AI-powered scams already registering at 15%.
The behavioural finding is the one to pin on the wall. While 83% of workers agree a cyberattack could have serious consequences and 72% are confident they can spot a suspicious email, only 54% say they actually check who sent a message before clicking a link. And fewer than half (48%) believe they could recognise a deepfake video. That is the intention-action gap measured at continental scale: confidence sits 18 points above the behaviour it is supposed to produce.
What does this mean for me? If you run a programme in Europe, this is free, citable baseline data for benchmarking and board reporting, from a source nobody will accuse of selling anything. More broadly, it is a reminder to stop measuring confidence and start measuring checking. "Do you feel able to spot phishing?" flatters your dashboard; "did you verify the sender?" tells you what is happening.
Sources: Euronews coverage | Eurobarometer survey page
When security slows the work, the work wins
A Sapio Research survey of 700 IT and security decision-makers in the US, UK, France and Germany (organisations of 500 or more staff, with a focus on frontline workers in healthcare and manufacturing) puts hard numbers on something every practitioner knows: 95% of respondents saw frontline workers using workarounds in the past year, from staying permanently signed in to sharing credentials to bypassing multi-factor authentication outright.
The why is right there in the friction data. Respondents estimate 37% of frontline workers hit an authentication problem in a typical month, each losing around 2.5 hours to it, and the single most-cited obstacle is logging in while wearing gloves or protective equipment. Nobody designed that login flow for a nurse mid-shift or a machine operator in PPE, so the workaround becomes the real process. One design detail stands out: organisations running a mix of passwords and passwordless saw credential sharing at twice the rate of fully passwordless ones. Half-migrations, it seems, keep the bad habits alive. Meanwhile, 62% reported a confirmed or suspected attempt to abuse account recovery or reset flows, and 60% saw social engineering attempts against the service desk.
What does this mean for me? Treat workaround reports as a friction map rather than a compliance problem. Where credentials are shared, authentication is failing the job, and the fix is design (shared-device flows, badge taps, glove-friendly methods), not a sterner module. It is also another data point that the recovery and reset path is now a favourite way in, so whatever human verification your service desk uses deserves the same attention as the login itself. The usual health warning: this is decision-makers estimating their workers' behaviour, not observed data.
Source: Help Net Security on the Sapio Research findings
The invite that outlives the quarantine
Two email security firms, Check Point and Sublime Security, separately documented an explosion in malicious calendar invites this month. Check Point tracked these campaigns growing from a few thousand emails a month in April to more than 118,000 in September, then over 740,000 in the first two weeks of October alone. Sublime saw a 1,216% month-on-month jump in August and September, running ahead of that. Campaigns range from fake Microsoft meeting invites harvesting credentials to Google Calendar invites delivering remote-access tooling.
The interesting part is why invites work. An invite reaches the inbox and the calendar at once, doubling the chances of a click. Because mail and calendars run on different protocols, a meeting can still sit on your calendar after the email that carried it has been quarantined, stripped of all the warning context. And the lure is a lovely piece of curiosity engineering: a meeting you do not remember booking is almost impossible to ignore, because ignoring real meetings has consequences.
What does this mean for me? Most phishing education still says "suspicious email". Calendar invites arrive through a channel people have been taught to treat as internal plumbing, so they start from a position of trust. Worth doing this week: add an unexpected-invite scenario to your training and reporting guidance, ask your email security team whether remediation actually removes the calendar event (in many setups it does not), and review auto-add settings for invites from outside the organisation.
Source: Help Net Security on the Check Point and Sublime Security research
Chrome starts catching the copy-paste con
Some good news to finish. On 20 October, Google announced a set of Chrome protections aimed squarely at scams that work by borrowing the user's hands. The standout target is ClickFix, the technique where a page invents a problem and instructs the user to copy and run a command to fix it. For users with Enhanced Protection switched on, Chrome will now check suspicious copied commands against Safe Browsing (with personal information stripped out first) and warn before harm is done. Alongside it comes server-side AI scam detection for fake antivirus and fake browser-update pages, plus a new two-tier warning design that lets Chrome flag suspicious sites earlier without crying wolf.
This matters because ClickFix has resisted conventional advice. Telling people "never paste commands a website gives you" asks them to hold a rule for a situation most have never heard of, and the command often differs from what the page displays. Moving the check into the browser, at the exact moment of the risky act, is choice architecture doing what awareness alone cannot.
What does this mean for me? Check whether Enhanced Protection fits your estate and your privacy posture, because these defences only cover users who have it switched on, and it is opt-in. There is a neat irony in Google shipping protections whose reach depends on a non-default setting, in a week all about defaults. It is also a useful case study for leadership: the control intervenes at the point of behaviour, which is exactly where your own programme's nudges should sit.
Source: Google: our latest defenses against evolving web scams
Signing off
A consistent thread this week, then. People are willing, confident, sometimes overconfident, and their behaviour follows the path their tools lay down. The organisations getting this right are not shouting louder; they are repaving. If you do one thing off the back of this edition, go and find your organisation's equivalent of the gloves problem: the place where the secure path and the practical path point in different directions. That is where your risk lives.
See you next Monday.