CyLab helps shape global report revealing gaps between cybersecurity knowledge and behavior

Most people know that protecting themselves online is important, but when it comes to putting that knowledge into practice, many are still falling short.

A new international report, developed with contributions from CyLab researchers, reveals a persistent disconnect between what people know about cybersecurity and how they actually behave online. The findings suggest that greater awareness alone may not be enough to keep people safe.

Released in October by the National Cybersecurity Alliance (NCA) and cybersecurity behavioral science company CybSafe, the sixth annual “Oh, Behave! The Annual Cybersecurity Attitudes and Behaviors Report 2026-2027” surveyed 5,000 adults across the United States, United Kingdom, India, Brazil, and Singapore to better understand their cybersecurity attitudes, experiences, and everyday habits.

This year's report was developed with input from CyLab researchers Lorrie Cranor, Lily Klucinec, Alexandra Li, and Ginger Smith, who collaborated with the report's authors to redesign portions of the survey and contribute new questions.

Their involvement helped introduce 19 new questions, primarily examining AI adoption, attitudes toward AI, and authentication technologies such as passkeys. Another 44 existing questions were modified to provide more detailed insights into people's cybersecurity beliefs and behaviors.

The collaboration also expanded the survey's examination of cybercrime to include four additional types of scams: job scams, delivery scams, online marketplace scams, and lottery or prize scams.

“One of the most important things we can learn from studying cybersecurity behavior is that knowing what to do and actually doing it are two very different things,” said Cranor. “If we want people to make better security decisions, we need to understand the obstacles they face and design technologies that make protecting themselves easier.”

The findings illustrate just how significant those obstacles can be. While 83 percent of respondents consider online security a priority and 73 percent say they know how to create strong passwords and do so, 46 percent reported including dictionary words in their passwords and 38 percent used personal information.

More than half of respondents (53 percent) said they do not regularly use multifactor authentication, while just 39 percent use passkeys, despite 70 percent reporting at least some familiarity with the technology.

These results reinforce an argument Cranor has advanced throughout her career: cybersecurity technologies should be designed around people's capabilities rather than expecting individuals to navigate increasingly complicated security requirements on their own.

In March, Cranor addressed this challenge during NCA’s's RSAC Executive Luncheon in San Francisco, where she participated in a discussion with cybersecurity expert John Elliott about the importance of making security more usable.

At the luncheon, Cranor highlighted how traditional security practices have often placed unrealistic demands on users, such as expecting them to remember dozens of long, complex, and unique passwords. She emphasized the importance of password managers and emerging authentication technologies like passkeys, which can reduce the burden on individuals while providing stronger protections.

Cranor also gave a featured presentation at NCA’s Convene: Boston Cybersecurity & Human Risk Conference in August, where she discussed research methods for studying scam susceptibility and evaluating interventions, and shared findings from several scam-related research studies that she has conducted with her students at CMU.

The report also reveals emerging challenges surrounding artificial intelligence. Eighty percent of respondents reported using AI tools, yet 56 percent of AI users said they had received no training on the security or privacy risks associated with the technology. Among respondents who use AI at work, 32 percent acknowledged sharing sensitive company information with AI tools without their employer's knowledge.

“The rapid adoption of AI introduces a whole new set of security and privacy challenges, especially when people don't fully understand what happens to the information they share with these systems,” said Cranor. “Organizations need to provide clear, practical guidance, but we also need to build safeguards into these technologies so that users aren't expected to recognize and prevent every potential risk themselves.”

The findings also challenge the assumption that people who have grown up with digital technology are necessarily better equipped to protect themselves online. Sixty-four percent of Gen Z respondents and 57 percent of millennials reported losing money or data to scams, compared with 33 percent of baby boomers. Younger respondents were also more likely to report encountering deepfake scams involving AI-generated phone or video calls.

Despite these challenges, the report identifies opportunities for improving cybersecurity education and training. Among respondents who completed cybersecurity training, 88 percent found it useful, with 54 percent reporting improvements in their ability to detect phishing attempts and 49 percent saying they had enabled multifactor authentication afterward. However, half of all respondents reported having no access to cybersecurity training at all.

For Cranor, the results underscore the importance of combining effective education with human-centered technology design, an approach central to CyLab's longstanding research in usable security and privacy.

“We shouldn't judge the success of cybersecurity efforts simply by whether people have watched training videos or can remember receiving security advice,” said Cranor. “The real measure is whether people can put that advice into practice. Ultimately, our goal should be to make secure behavior the easiest and most natural choice, rather than something that requires constant attention and effort.”