Security Awareness and Phishing Behavior Survey

Thanks for taking a few minutes on this. We're checking how security training actually shows up in day-to-day decisions — there are no wrong answers, and this isn't tied to any individual review. Your responses are completely confidential and anonymized. About 5 minutes.

In the last 12 months, which security awareness training have you completed?

• General security awareness course
• Phishing simulation exercise
• Data handling / privacy training
• Remote work security training
• None that I can recall

How confident are you that you could correctly identify a phishing email if one landed in your inbox today?

In the last 30 days, how often have you encountered an email, text, or message that seemed suspicious?

• Never
• Once
• A few times
• Weekly or more often

Thinking about the most recent suspicious message you saw, what did you actually do?

• Reported it through the official channel
• Deleted or ignored it without reporting
• Clicked a link or opened an attachment before realizing
• Forwarded it to a coworker to check
• Wasn't sure what to do, so did nothing

How much do you agree with each statement about security at your organization?

Which of these security topics would be most and least valuable to cover in future training?

• Spotting phishing emails and texts
• Creating and managing strong passwords
• Securing home and remote work networks
• Recognizing phone-based social engineering
• Physical security (badges, tailgating, visitors)
• Handling sensitive customer or company data
• Safe use of cloud storage and file sharing
• Mobile device and app security

Ask the respondent to walk through the last time they felt even briefly unsure about a message, link, or request — what made it feel off, what they actually did in the moment, and whether they told anyone. If they say they'd always report something, probe for a specific counterexample or reason reporting felt awkward, slow, or pointless. If they can't recall any suspicious moment, ask what would make them notice one.

If you suspected your account had been compromised right now, would you know exactly who to contact?

• Yes, I know exactly who
• I have a rough idea
• No, I would have to search for it

How would you rate the format and length of the security training you've received?

Which best describes your department?

• Engineering / IT
• Sales / Marketing
• Finance / Legal
• Operations / HR
• Customer Support
• Other
• Prefer not to say

How long have you been with the organization?

• Less than 6 months
• 6 months to 2 years
• 2 to 5 years
• More than 5 years
• Prefer not to say

That's everything — thank you. Your answers, along with everyone else's, will be used to shape more relevant, less generic security training and to fix any gaps in how easy it is to report concerns.