The National Cybersecurity Alliance and CybSafe’s Oh, Behave! Report Finds Cybersecurity Awareness Is High – and People Are Ready to Act
In its sixth iteration, the report explores how effective training, stronger workplace guidance and simple habit
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
WASHINGTON, Oct. 22, 2026 (GLOBE NEWSWIRE) — The National Cybersecurity Alliance (NCA), the nation’s leading nonprofit dedicated to empowering individuals to protect themselves from cybercrime and scams, and CybSafe, the leading behavioral risk platform, today announced the release of Oh, Behave! The Annual Cybersecurity Attitudes and Behaviors Report 2026-2027. Surveying 5,000 adults across the United States, United Kingdom, India, Brazil and Singapore between April 28 and May 19, 2026, the report finds that people increasingly understand the stakes of staying secure online — creating an opportunity to close the gap between awareness and action.
U.S. adults recognize the importance of cybersecurity, with 58% reporting that falling victim is a concern for them. At the same time, 80% of people globally now use AI, rapidly changing the ways people work, communicate and navigate the digital world. The opportunity is clear: people recognize the stakes and want to stay secure, but need practical training and guidance to turn that awareness into everyday action.
“People understand that cybersecurity is important, and that awareness gives us something powerful to build on,” said Lisa Plaggemier, Executive Director of the National Cybersecurity Alliance. “Our focus now should be on making secure behavior easier and more accessible, giving people practical training and guidance they can use in their everyday lives, particularly as AI continues to change how we work and interact online.”
“Awareness was never the finish line, behaviour change is,” said Oz Alashe MBE, CEO and Founder of CybSafe. “This year’s Oh, Behave! data shows people are ready and willing to adapt and act. The missing piece is support, in the moment, that turns good intent into secure habits. That means understanding the behaviours driving risk, not simply measuring what people know. It means giving organisations the evidence to see what is actually changing, not just what training has been completed.”
Overview of key report insights:
Americans feel the urgency of cybersecurity, and that’s a foundation to build on. Eight in ten U.S. adults (81%) consider staying secure online a priority, in line with the other surveyed countries (81–86%). Concern is also high: 58% fear becoming a victim of cybercrime. That anxiety isn’t paralysis — it’s readiness. Channeled into training and better habits, it represents the strongest possible starting point for change.
AI has created a new and urgent workplace challenge — one that employers must address now. Eight in ten people (80%) now use AI in some form, but 56% of AI users have received zero security or privacy training related to it. Nearly a third of workplace AI users (32%) have shared sensitive company information with an AI tool without employer knowledge — not out of malice, but because 43% of users say their employer has not clearly communicated what they can share. Clear AI policies and training aren’t a nice-to-have; they’re overdue.
Training works, but too few people are getting it. Of those who did receive cybersecurity training, 88% found it useful. Fifty-four percent got better at spotting phishing, 49% set up MFA, and 46% adopted a password manager. Yet more than half of employed Americans (55%) face no mandatory training at their workplace, and half the global population has had none at all.
Young people are the highest-risk group, and the most reachable. Gen Z suffers the highest cybercrime victimization rate of any generation with 64% having lost money or data to scams. They are the most digitally engaged, preferring video-based training (54%), followed by periodic online courses (39%) and short, bite-sized information (34%). Meeting them where they are (with the right formats, not dry annual refreshers) could dramatically shift outcomes for the most targeted group online.
Simple habit changes could close the biggest gaps. The most common vulnerabilities are also the most fixable: 53% of participants do not use MFA regularly, 60% recycle passwords, and 46% rely on dictionary words. Yet 70% already know what passkeys are, and biometric adoption is growing. The knowledge exists. What’s needed is the nudge, the norm, and the workplace culture that makes secure behavior the path of least resistance.
Employers hold more power than they realize. Less than half of employed people globally (47%) face any mandatory cybersecurity training. Forty-three percent of workplace AI users say their employer hasn’t clearly communicated what’s appropriate. Forty-one percent of AI-using workers started using these tools entirely on their own initiative. Employers who invest in clear policies and regular training don’t just protect their data; they build the kind of security culture that protects everyone.
The global gap is an opportunity. Countries like Singapore (66% training access) and the UK (strong MFA and password habits) show what’s possible when training is prioritized and normalized. The U.S. has the awareness and the urgency. Learning from peers who’ve bridged the gap between knowing and doing could accelerate progress significantly.
The report comes just in time to close out the 23rd Annual Cybersecurity Awareness month, an initiative launched in 2004, and led by the National Cybersecurity Alliance and the Cybersecurity and Infrastructure Security Agency (CISA).
To download the full “Oh, Behave! The annual Cybersecurity Attitudes and Behaviors Report 2026-2027,” visit here.
About CybSafe
CybSafe is a cybersecurity software platform transforming how organizations manage human risk in the AI era. It integrates with existing tools and uses behavioral data and intelligent automation to surface real risk signals, deliver science-backed interventions, and track behavior change—reducing the likelihood and impact of cyber incidents before they disrupt the business.
Headquartered in London with a global customer base, CybSafe is backed by a team of scientists, data analysts, and security experts driving pioneering research into human decision-making and security behavior. At the core of the platform is SebDB, the world’s first cybersecurity behavior database, which maps security behaviors to risk outcomes, frameworks, and controls. This behavioral ontology enables organizations to quantify human risk, accelerate compliance, and build resilient security cultures.
For more information, please visit www.cybsafe.com.
About National Cybersecurity Alliance
The National Cybersecurity Alliance is a nonprofit organization on a mission to empower individuals to protect themselves from cybercrime and scams. We advocate for the responsible use of technology, educate individuals and organizations on cybersecurity best practices, and foster strong public-private partnerships to promote digital safety. Core initiatives include Cybersecurity Awareness Month (October), Data Privacy Week (January), and CyberSecure My Business™, which provides resources and workshops to help businesses stay resilient against cyber threats. For more information, visit https://staysafeonline.org.
Media Contact: Krystle Cajas Email: krystle.cajas@modop.com
Media gallery
