Employee Phishing Readiness & Security Behavior Assessment

Welcome to the Phishing Readiness & Security Behavior Survey. This survey asks about your experiences with suspicious messages, your security habits, and your ideas for improvement. It should take approximately 6–8 minutes to complete. Your participation is completely voluntary and you may stop at any time. There are no right or wrong answers—we are interested in your honest experiences and opinions. All responses are confidential and will be reported only in aggregate. Please click 'Next' to begin.

To the best of your knowledge, did you receive any message you considered suspicious (email, SMS/text, or chat) in the past 30 days?

• Yes
• No
• Not sure

In the past 60 days, how often did you hover over or inspect links before clicking them in emails or messages?

How confident are you that you could handle a suspicious message appropriately?

What is your most common way to report a suspected phishing message?

• Report Phish button/add-in in email
• Security email alias
• IT helpdesk ticket
• Messaging app bot
• Tell my manager
• I don't report them
• I'm not sure how to report

When did you last complete security awareness training?

• Within the last 30 days
• 31–90 days ago
• 3–6 months ago
• More than 6 months ago
• I have not completed it
• I don't remember

What is your primary role?

• Engineering/IT
• Operations
• Finance/Accounting
• Sales/Marketing
• HR/People
• Legal/Compliance
• Product/Design
• Customer Support/Success
• Executive/Leadership
• Other

Based on your responses in this survey, please share any additional thoughts about what would help you handle phishing attempts more effectively.

Approximately how many suspicious or phishing-like messages did you notice in the past 30 days?

• 1–2
• 3–5
• 6–10
• 11–20
• More than 20

In the past 60 days, how often did you verify the sender's identity before acting on a request (e.g., checking the email address or calling the person)?

When judging whether an email is legitimate, rank these cues from most to least important to you.

1. Sender domain and address
2. Link URL on hover
3. Urgent or threatening tone
4. Unexpected attachments or requests for credentials

When you do report a suspicious message, approximately how long does it typically take from the moment you notice it?

• Within 5 minutes
• 5–30 minutes
• 30–60 minutes
• 1–4 hours
• More than 4 hours
• I typically don't report suspicious messages

Rank the following areas by where investment would most improve phishing readiness for your team, from highest to lowest priority.

1. Better reporting tools and integrations
2. More frequent simulated phishing exercises
3. Improved training content and refreshers
4. Faster feedback after reports
5. Just-in-time guidance in email apps
6. Manager reinforcement and team nudges

How long have you been with the company?

• Less than 6 months
• 6–12 months
• 1–3 years
• 3–5 years
• More than 5 years

We'd like to understand more about how you handle suspicious messages. Imagine a senior executive emails you requesting urgent gift card codes. Walk us through what you would do and why.

In the past 60 days, how often did you report suspicious messages through your organization's official reporting channel?

Which of the following actions are recommended when you suspect a message is a phishing attempt? Select all that apply.

• Use the report button or security alias
• Avoid clicking links or opening attachments
• Verify the request through a known, separate channel
• Share the suspicious email in a public chat
• Forward to personal email to check later
• Reply to the sender asking if it's legitimate
• Delete without reporting

What are the biggest things that slow you down or stop you from reporting suspicious messages? Select up to 3.

• Not sure what information to include in a report
• Unsure which channel to use
• Worried about reporting a false alarm
• Too busy or it takes too long
• Reporting tools are hard to find or use
• No feedback after reporting
• I resolve it myself instead of reporting
• None of the above

In which region do you primarily work?

• Americas
• EMEA
• APAC
• Multiple regions
• Other

Thank you for completing this survey. Your responses will be analyzed in aggregate to identify training priorities and strengthen our organization's security posture. All answers are confidential.

In the past 60 days, how often did you check a URL or website address before entering login credentials?

What is your typical work setting?

• Primarily in-office
• Hybrid
• Primarily remote

Which of the following security practices do you currently use on your primary work devices? Select all that apply.

• Multi-factor authentication (MFA)
• Password manager for work accounts
• Automatic OS and browser updates enabled
• Lock screen when stepping away
• VPN on public networks
• Unique passwords for each service
• Phishing-report add-in/button installed
• None of these