We found this central tension in Oh, Behave! The Annual Cybersecurity Attitudes and Behaviors Report 2026–2027, from the National Cybersecurity Alliance (NCA) and CybSafe. The sixth annual report surveyed 5,000 adults across the United States, United Kingdom, India, Brazil, and Singapore between April 28 and May 19, 2026.

In many ways, the results are encouraging! Most respondents (83%) said digital security is a top priority, and 70% believe staying safe online is achievable.

However, those attitudes don't always show up in people's habits. Half of respondents have already fallen victim to a scam. People who know how to create strong passwords still use predictable ones! More than half don't regularly use multifactor authentication (MFA). And as AI becomes part of everyday life, people are sharing sensitive information.

In other words, the cybersecurity problem isn't simply that people don't know enough. It's that knowing isn't always enough.

The knowing-doing gap is alive and kicking 

When it comes to passwords, 73% of respondents say they know how to build a strong one. Yet 46% still use dictionary words, while 38% use personal details in their passwords. When it comes to managing those passwords, convenience still reigns supreme. People are more than twice as likely to write passwords in a paper notebook (28%) or rely on memory (23%) than to use a password manager (11%). 

MFA is a similar story. Most respondents (53%) don't use MFA regularly. Of those, 21% know how to use MFA and simply choose not to! 

The takeaway is that many people know best practices! But the gap is between knowing what to do and consistently making the secure choice. 

This matters because it means awareness efforts can only go so far. Telling people that MFA is important doesn't necessarily make MFA the easiest choice. Explaining password security doesn't automatically overcome the convenience of reusing a familiar password. 

How AI is changing the equation

The rise of consumer-grade AI and large language models (LLMs) is making the knowing-doing gap more complicated. Four out of five people surveyed now use AI tools, and 44% use them in both their work and personal lives. AI is no longer something people encounter occasionally or exclusively at work. For many, it's part of the daily routine.

Guidance and training, though, haven’t kept pace with adoption. Fifty-six percent of AI users have received no security or privacy training related to the tools they use.

Nearly one-third (32%) of employees who use AI at work say they have shared sensitive company information with an AI tool without their employer knowing. The information shared most often includes internal documents, customer data, and financial data.

We also found out that people are increasingly treating AI tools as confidants – 18% of respondents say they have told an AI chatbot a secret they have never told another person. Another 40% have shared health information, while 32% have shared personal feelings.

But people also worry about risks—over 2 in 3 say they fear AI-driven scams. This contradiction matters: people recognize that AI creates risks while still trusting AI tools with highly sensitive information.

The solution isn't simply telling people to stop using AI, but guiding them on what is appropriate to share, what isn't, and how to use these tools safely.

Cybercrime isn't hypothetical anymore for many of us 

For half of respondents, the consequences of poor cybersecurity behavior aren't theoretical; they said they have already fallen victim to a scam. 

Phishing was the most common incident type, accounting for 16% of reported incidents. Fake job offers, identity theft, and online marketplace scams also ranked prominently.  

Yet concern about cybercrime doesn't always translate into a sense of personal vulnerability. In the U.S., 66% of adults are concerned about becoming a victim of cybercrime, but just 37% believe it will happen to them. 

It appears to be another version of the knowing-doing gap. It's easier to take a risk when the consequences feel abstract, even when we know they're real. 

Increasingly, many of these risks involve AI-assisted scams. Over 1 in 3 respondents say they have received a deepfake phone or video call. Of those, 40% say they lost money or data as a result. 

Education must evolve with the threats. People aren't just being asked to recognize suspicious emails anymore; they also need to question whether a familiar voice or video is authentic. 

Training is a good defense…when people get it

We found that cybersecurity training seems to make a difference. A vast majority (88%) of respondents who received cybersecurity training said they found it useful. Among those who received training, 54% became better at spotting phishing, 49% set up MFA, and 46% adopted a password manager.

But access remains a challenge, especially since many security training programs are tied to workplaces. Less than half of employed people globally (47%) receive mandatory cybersecurity training. In the U.S., 55% of employed adults report that their workplace does not require such training.

Even when training is available, people don't always participate. As expected, the most common reason for skipping training is lack of time (21%), followed by the belief that they already know enough (19%). That suggests security teams must jump over two high hurdles: making training effective and efficient, and making people want to take it.

Long, generic annual training will struggle to compete for attention. Shorter, more relevant and interactive approaches may have a better chance of meeting people where they are.

Employers play an important role in this ecosystem. Clear policies are paramount. Practical training that explains not just what employees shouldn't do, but what they can do safely, is critical. How do we all make secure behavior easier?

Turning awareness into easy habits

The findings from Oh, Behave! don't paint a picture of people who don't care about cybersecurity. It's actually the opposite. But the challenge is turning that awareness into habits.

We think this means designing security around real human behavior rather than expecting people to behave like textbooks. Think about how we can make products and platforms secure by design. How can we reduce reliance on MFA and password managers? And how do we deliver effective training that people have time to take and are interested in learning from?

Most importantly, we think this report tells us people aren't the weakest link in cybersecurity, because they're the ones who ultimately have to make security work!

Read the 2026 Oh, Behave! report, and if you want more security resources, sign up for our free email newsletter!