Every October, Europe marks European Cybersecurity Month (ECSM), an annual European initiative to raise cybersecurity awareness, supported by the European Union Agency for Cybersecurity (ENISA) and the European Commission.
In 2026, key areas of focus include cybersecurity in the workplace, employees’ cybersecurity skills, and their ability to recognise and respond to cyber threats.
For organisations, this raises a practical question: is it enough for employees to know the basic rules of information security, or should organisations also assess their ability to apply those rules in real-world situations?
Data from a European Commission Eurobarometer survey, presented in connection with the initiative, indicate that employees encounter various cyber threats in their daily work. At the same time, the findings reveal a gap between awareness of risks, willingness to participate in training, and the regular provision of cybersecurity information.
 
What Do the Data Reveal About Cybersecurity in the Workplace?
The Eurobarometer findings highlight three important figures:

• 74% of surveyed employees report having received suspicious emails, messages or links at work during the previous six months.
• 45% say their organisation regularly provides cybersecurity information or updates.
• 85% are interested in improving their cybersecurity knowledge and skills.

These findings indicate that employees are exposed to cyber threats and are willing to improve their preparedness, but regular cybersecurity information is not consistently provided across organisations.
The survey findings cannot automatically be applied to every individual organisation. However, they raise the question of whether existing training programmes, rules and controls provide an adequate level of preparedness.

Awareness Does Not Necessarily Translate into Preparedness
An employee may know what phishing is, but this does not necessarily mean they will recognise a carefully crafted fraudulent message.
The survey reports that 39% of respondents have received phishing or scam emails, while 18% report attempts at identity theft.
These findings demonstrate that employees encounter different types of cyber threats in their daily work. Recognising such attempts requires not only an understanding of the main risks but also practical skills in verifying suspicious requests and responding appropriately.
Similarly, knowing the rules for handling information does not guarantee that they will be followed under pressure, when dealing with urgent tasks or in unusual situations.
Increasingly sophisticated social engineering techniques further complicate this environment. Attackers use various manipulation techniques, including impersonating trusted individuals, creating a sense of urgency, requesting confirmation of access rights or seeking changes to payment details.
Artificial intelligence also increases the potential for creating convincing fraudulent messages, images and voice recordings.
Therefore, awareness should be regarded as a foundation for developing practical skills, rather than as evidence of preparedness in itself.
For an organisation, what matters is not only whether employees are familiar with the threats but also whether they can respond appropriately when confronted with them.

Why Does Interest in Training Not Always Lead to Better Preparedness?
The Eurobarometer findings indicate considerable interest among employees in improving their cybersecurity skills. However, practical barriers to participating in training remain.
Reported obstacles include insufficient time during the working day (26%), training costs (16%), inadequate information about available opportunities and a lack of employer support.
These findings demonstrate that employees’ willingness to develop their skills is not sufficient on its own. Organisational support is also necessary.
For employers, this means treating cybersecurity training as part of risk management rather than merely as a periodic administrative requirement.
Particular importance should be placed on the accessibility of training, its practical relevance and its alignment with employees’ specific responsibilities.
However, even when training is conducted regularly, the question remains whether the knowledge acquired is applied in practice. This is where phishing simulations, social engineering tests and other forms of practical assessment become valuable.

How Can Organisations Assess Their Preparedness?
Assessing preparedness requires more than tracking the number of training sessions delivered or certificates issued.
Practical assessments can provide insight into employees’ actual behaviour and the effectiveness of implemented controls.
Phishing Simulations
Phishing simulations are controlled exercises in which employees receive specially prepared messages designed to resemble real phishing attempts.
Their purpose is to assess employees’ ability to recognise suspicious messages and respond in accordance with established procedures.
Such simulations can track indicators including:

• the proportion of employees who opened the simulated message;
• the percentage of employees who clicked a suspicious link;
• attempts to submit information in a controlled testing environment;
• the percentage of employees who reported the suspicious message;
• the time required to report the message;
• changes in results across subsequent simulations.

These indicators should be analysed in the context of the specific organisation. For example, simply opening an email does not necessarily constitute a breach of security rules.
An especially important indicator is employees’ ability to recognise and promptly report a potential threat.
The results can help identify the need for additional training, improvements to procedures or the implementation of additional security controls.

Social Engineering Tests
Phishing simulations are one form of social engineering testing.
Depending on the risks faced by an organisation, other controlled assessments may also be conducted, such as:

• simulated telephone calls from individuals impersonating technical support personnel;
• attempts to obtain information by impersonating an employee or supplier;
• assessments of identity verification procedures;
• simulated requests to grant or modify access rights.

Such assessments should be planned and authorised in advance and conducted under clearly defined rules that minimise the risk of disrupting operations or compromising actual information.
These assessments may form part of a broader information security assessment, including vulnerability assessments, penetration testing and social engineering tests.

Evaluating the Effectiveness of Implemented Controls
An organisation’s preparedness does not depend solely on the behaviour of individual employees.
It is also necessary to assess whether established processes support an appropriate response to potential threats.
For example:

• Is there a clear and accessible mechanism for reporting suspicious messages?
• Do employees know whom to contact when they suspect a threat?
• Is there an established procedure for verifying unusual payment requests or changes to bank account details?
• Are appropriate controls applied when granting access?
• Are the results of simulations, assessments and actual incidents analysed?
• Are corrective actions taken when weaknesses are identified?

These aspects may be assessed as part of an information systems audit (IT audit), which examines both the technical and organisational aspects of information security.

From Training Completion to Evaluating Effectiveness
The data presented in connection with European Cybersecurity Month 2026 highlight the need for consistent efforts to develop employees’ skills and preparedness.
For organisations, the key question is not simply how many employees have completed training, but whether the measures implemented lead to better threat recognition, timely reporting and proper application of established procedures.
Phishing simulations, social engineering tests and periodic effectiveness evaluations can provide valuable information about the actual state of an organisation’s security.
The results of these activities should be used to improve processes and competencies, rather than merely to identify individual mistakes.
Effective preparedness for cyber threats is built through a combination of knowledge, practical skills, clear procedures and effective controls. An organisation’s ability to evaluate and continually improve these elements is essential to effective information security management.

Sources:
ENISA
Eurobarometer