UK workers spot phishing but rarely report it, CybSafe study finds
UK employees are the most likely of five global markets to check messages for phishing signs, yet the least likely to follow through and report what they spot. That is the headline finding of the 2026/27 Oh, Behave! Report, published jointly by cybersecurity behaviour change platform CybSafe and the National Cybersecurity Alliance (NCA), based on a survey of 1,000 respondents in each of the UK, US, India, Brazil and Singapore.
More than two-thirds of UK respondents (68 per cent) said they check messages very often or always for phishing indicators. Just 37 per cent report suspicious messages with similar regularity, a gap of 31 percentage points. That reporting rate is the lowest across all five markets surveyed; the other four countries recorded rates between 39 and 43 per cent. Almost a quarter of UK respondents (24 per cent) said they rarely or never report phishing, and one in ten said they either do not know how or have never seen a way to do so.
Deepfakes and the cost of inaction
The consequences of that gap are tangible. Nearly a quarter of UK respondents (22 per cent) said they had received a deepfake scam or video call, and 36 per cent of those people reported losing money or data as a result. As AI-generated voice and video cloning becomes cheaper and more accessible, the frequency and plausibility of such attacks is expected to increase, raising the stakes of any lag between detection and disclosure.
The report also surfaces a paradox in UK cyber hygiene more broadly. UK respondents recorded the lowest use of personal information such as pet names or birthdays in passwords (31 per cent, against 50 per cent in India), the highest regular use of multi-factor authentication (59 per cent), and the highest rate of regularly installing software updates (62 per cent). Yet 57 per cent of UK respondents said they have no access to cybersecurity training at all, a figure second only to Brazil at 64 per cent.
"The striking finding is the gap between checking and reporting," said Dr Jason Nurse, Director of Science and Research at CybSafe and Reader in Cyber Security at the University of Kent. "One good security habit does not tell us whether someone takes the next step. We need to measure behaviours directly, understand what gets in the way and test whether the support people receive makes a difference."
Regulatory read-across
The findings carry direct relevance for organisations subject to DORA and NIS2. Both frameworks, which came into force across EU member states and apply to UK-linked financial entities through contractual and operational channels, require firms to demonstrate that cyber-risk management processes function in practice, not merely in policy documentation. A workforce that can spot a phishing message but routinely fails to report it represents an incomplete incident-detection chain; threat intelligence that never surfaces to security operations teams cannot trigger the response timelines those regulations mandate.
For security leaders, the report raises a practical measurement question: are training programmes being assessed on completion rates, or on whether employee behaviour actually changes? CybSafe's platform is built around behavioural science and what it calls SebDB, a proprietary database of security behaviours, with the stated aim of identifying risky patterns and measuring whether targeted intervention shifts them. The vendor's commercial interest in the question is obvious, but the underlying methodological point, that awareness metrics and behaviour metrics are different things, is broadly accepted in the security-awareness field.
Oz Alashe, CEO of CybSafe, said organisations need to make reporting easier by providing clear routes, meaningful feedback and visible follow-through. Closing the 31-point gap, rather than optimising check-box training completion, is where the next phase of human-layer security investment is likely to focus.