Employees are worried their workplace will be the target of a cyber attack, and that they may be the ones leaving their organization vulnerable, according to a new EY survey.
Concern about escalating cybersecurity threats in the workplace is growing among U.S. employees. More than half (53%) are worried their organization will be the target of a cyber attack, and a third (34%) are worried their actions may be leaving their organization vulnerable, according to new data from Ernst & Young LLP (EY US). Fear of exposing their organization to a cyber attack is particularly high among younger generations. Gen Z and Millennial employees are less likely to feel equipped to identify and respond to cyber threats compared to their older colleagues.
The 2024 Human Risk in Cybersecurity Survey explores the current state of cybersecurity, and reveals key insights for business leaders on cybersecurity awareness and practices. It is a follow up to an initial 2022 analysis by EY US. This year, EY US expanded the study to analyze employee perception of the role of artificial intelligence (AI) in escalating threats. The survey found 85% of workers believe AI has made cybersecurity attacks more sophisticated; 78% are concerned about the use of AI in cyber attacks; and 39% of employees are not confident that they know how to use AI responsibly.
“With new threats emerging on a near-constant basis fueled by geopolitical tensions, shifting regulations and the rapid integration of new technologies, including AI, the risk landscape has become even more complicated,” said Jim Guinn, II, EY Americas Cybersecurity Leader. “Want to secure your organization today and in the future? Put humans at the center of your cyber strategy and enlist your people as protectors on the frontlines, arming them with knowledge, training and a dose of healthy skepticism about all digital interactions.”
Closing The Cybersecurity Preparedness Gap
The latest cybersecurity study highlights a persistent gap in preparedness across generations: Younger workers continue to fall short of exercising safe cybersecurity practices more so than older generations. In fact, Gen Z is losing confidence in their ability to recognize phishing attempts — one of the most common and successful tactics of social engineering attacks — and is most likely to admit to opening a suspicious link. Spotting malicious links and content is getting even harder with the power of AI-generated phishing emails. Only 31% of Gen Z feel very confident identifying phishing attempts, a nine percentage point drop from 40% in 2022; 72% said they have opened an unfamiliar link that seemed suspicious at work, far higher than Millennials (51%), Gen X (36%) and Baby Boomers (26%).
Nearly two-in-three Gen Z and Millennial workers are particularly fearful about repercussions surrounding cybersecurity, including 64% of Gen Z and 58% of Millennials who fear they would lose their job if they ever left their organization vulnerable to an attack. Younger generations are also more likely to not fully understand what their organization’s process is to report suspected cyber attacks, even though their organization has a process in place (39% Gen Z and 29% Millennials vs. 19% Gen X and 15% Baby Boomers).
Despite concerns around their abilities to prevent an attack, EY research indicates that Gen Z workers increasingly consider themselves knowledgeable about cybersecurity (86% vs. 75% in 2022). This is due to employers investing in upskilling and training that caters to their experience as digital natives.
5 Tips For Cultivating Cyber Confidence
AI’s rapidly evolving nature has made it essential for organizations to adapt training protocols regularly, and remain committed to providing frequent, up-to-date training that addresses the latest AI-driven threats and cybercrime trends. A vast majority of employees (91%) say organizations should regularly update their training to keep pace with AI, especially as AI’s role evolves in cyber threats. But only 62% say their employer has made educating employees about responsible AI usage a priority.
“Cybersecurity training and attention from leaders across the C-suite contributes to the development of a strong security posture within an organization,” said Dan Mellen, EY Americas Consulting Cybersecurity Chief Technology Officer. “When security practices are ingrained in the company culture, employees are more likely to prioritize security in their day-to-day activities and proactively report potential security incidents.”
The EY Cybersecurity team advises C-suite and senior business leaders to incorporate the following five practices in their cyber agenda to cultivate a strong and confident security culture within their organization:
- Build robust training exercises that are reinforced year-round. EY US research finds employees who are “rusty” on cybersecurity training are most fearful of using technology at work. Conversely, 94% of employees who received training within the past year say cybersecurity is a priority to them.
- Drive employee engagement with gamification. Leaderboards and multiplayer features in gamified training programs encourage healthy competition among employees, driving them to perform better. Gamification is particularly effective for anti-social engineering campaigns if it addresses the natural human curiosity that often leaves employees vulnerable.
- Partner, don’t police. Organizations testing their employees to see if they handle cybersecurity threats appropriately can inadvertently turn cyber training into a “gotcha” moment. Position cybersecurity protocols as working in partnership with their employees, not as police, by embracing a “see something, say something” policy instead. Make the process for reporting potential attacks and vulnerabilities simple enough that workers across all generations can seamlessly integrate it into their day-to-day lives.
- Incorporate hands-on AI training protocols. Including protocols that incorporate hands-on training for the use of AI in the workplace offers employees exposure to fundamental capabilities and risks. Having firsthand experience using new technologies like generative AI unlocks a new level of understanding and drives defensive thinking.
- Lead by example with responsible AI: 39% of employees are not confident that they know how to use AI responsibly, according to EY US research. As stewards of their organization, C-suite and senior leaders must embrace transparency surrounding how AI is developed and deployed enterprise-wide and demonstrate responsible AI practices themselves to mitigate risks.
Read more about business resilience and continuity at Continuity Insights.
