Eye-opening Insights from the 2023 Annual Cybersecurity Attitudes and Behaviours Report
Tanya Wetson-Catt • 16 April 2024
We are living in an era dominated by digital connectivity. You can't overstate the importance of cybersecurity. As technology advances, so do the threats that lurk in the online world.
Often, it’s our own actions that leave us most at risk of a cyberattack or online scam. Risky behaviours include weak passwords and lax security policies. As well as thinking “This won’t happen to me.” This is why human error is the cause of approximately 88% of data breaches.
The National Cybersecurity Alliance and CybSafe are working to correct poor cyber hygiene. Each year, the duo publishes a report on cybersecurity attitudes and behaviours. The goal is to educate both people and businesses. To educate them on how to better secure their digital landscapes.
This year’s study surveyed over 6,000 people across the U.S., Canada, the U.K., Germany, France, and New Zealand. The survey asked about several things. These include knowledge of cybersecurity risks, security best practices, and challenges faced.
The report reveals some eye-opening insights. These include how people perceive and respond to cyber threats as well as what they can do to improve their cybersecurity posture. Here are some of the key findings from the report.
We Are Online… a Lot
It’s no surprise that 93% of the study participants are online daily. The logins we create continue to expand, as well as those considered “sensitive.” Sensitive accounts hold personal information that could be harmful if stolen.
Nearly half (47%) of the study’s respondents have ten or more sensitive online accounts. This amplifies risk. Especially if people are using the same password for two or more of those accounts.
Online Security Makes People Frustrated
Most people (84%) feel that online security is a priority. But as many as 39% feel frustrated, and nearly the same amount intimidated. It can seem that you just can’t get ahead of the hackers. Just over half of people thought digital security was under their control. That leaves a whole lot that don’t think so.
But that is no reason to let down your defences and become an easy target. There are best practices you can put in place to safeguard your online accounts that work.
These include:
- Enabling multi-factor authentication on your accounts
- Using an email spam filter to catch phishing emails
- Adding a DNS filter to block malicious websites
- Using strong password best practices
People Need More Access to Cybersecurity Training
One way to reduce human errors associated with cybersecurity is to train people. The survey found that just 26% of respondents had access to cybersecurity training.
It also broke this down by employment status. We see that those not actively employed are most lacking. Even those employed can use more training access and encouragement. Just 53% report having access to cybersecurity awareness training and using it.
Employers can significantly reduce their risk of falling victim to a data breach. They can do this by beefing up their security awareness training. There is also a large opportunity to provide more training. Particularly to those retired or not actively employed.
Cybercrime Reporting Is Increasing
Over a quarter (27%) of survey participants said they had been a victim of cybercrime.
The types of cybercrimes reported include:
- Phishing (47%)
- Online dating scams (27%)
- Identity theft (26%)
Which generation reported the most cybercrime incidents? Millennials. In fact, Baby Boomers and the Silent Generation reported the fewest.
No matter where you fall in the generations, it’s important to adopt security best practices. We’ll go through some of these next.
Online Security Best Practices to Reduce Your Risk
1.Strong, Unique Passwords:
- Start with the basics. Create strong, unique passwords for each online account.
- Use a combination of uppercase and lowercase letters, numbers, and special characters
2.Multi-Factor Authentication (MFA):
- Enhance your account security with multi-factor authentication.
- MFA adds an extra barrier to unauthorized access. Even for compromised passwords.
3. Regular Software Updates:
- Keep all your software, including operating systems and mobile apps, up to date.
4. Beware of Phishing Attacks:
- Exercise caution when clicking on links or opening attachments. Especially in emails from unknown sources.
- Verify the legitimacy of emails and websites. Check for subtle signs, such as misspelled URLs or unfamiliar sender addresses.
5. Use Secure Wi-Fi Networks:
- Ensure you connect to a secure and password-protected Wi-Fi network.
- Avoid using public Wi-Fi for sensitive transactions. Unless using a virtual private network (VPN).
6. Data Backup:
- Regularly back up important data to an external device or a secure cloud service.
7. Use Antivirus and Anti-Malware Software:
- Install reputable antivirus and anti-malware software on all devices.
- Regularly scan your systems for potential threats.
8. Be Mindful of Social Media Settings:
- Review and adjust your privacy settings on social media platforms.
- Limit the amount of personal information visible to the public.
9. Secure Your Personal Devices:
- Lock your devices with strong passwords or biometric authentication.
10. Educate and Stay Informed:
- Educate yourself and your team through cybersecurity awareness programs. This fosters a culture of vigilance and preparedness.
Schedule Cybersecurity Awareness Training Today
A little education on cybersecurity goes a long way toward protecting your data. Our experts can provide security training at the level you need. We’ll help you fortify your defenses against phishing, scams, and cyberattacks.
Contact us today to schedule a chat.
More from our blog
When you first move your data and computing resources to the cloud, the bills often seem manageable. But as your business grows, a worrying trend can appear. Your cloud expenses start climbing faster than your revenue. This is not just normal growth, it is a phenomenon called cloud waste, the hidden drain on your budget hiding in your monthly cloud invoice. Cloud waste happens when you spend money on resources that do not add value to your business. Examples include underused servers, storage for completed or abandoned projects, and development or testing environments left active over the weekend. It is like keeping every piece of equipment in your factory running all the time, even when it is not needed. The cloud makes it easy to spin up resources on demand, but the same flexibility can make it easy to forget to turn them off. Most providers use a pay-as-you-go model, so the billing meter is always running. Controlling cloud waste is not just about saving money. Every dollar you save can be reinvested in innovation, stronger security, or your team. The Hidden Sources of Your Leaking Budget Cloud waste can be surprisingly easy to overlook. A common example is over-provisioning. You launch a virtual server for a project, thinking you might need a larger instance just to be safe, and then forget to scale it down. That server keeps running and billing you every hour, month after month. Orphaned resources are another common drain, especially in companies with many projects or large teams. When a project ends, do you remember to delete the storage disks, load balancers, or IP addresses that were used? Often, they stay active indefinitely. Idle resources, like databases or containers that are set up but rarely accessed, quietly add up over time. According to a 2025 report by VMWare that drew responses from over 1,800 global IT leaders, about 49% of the respondents believe that more than 25% of their public cloud expenditure is wasted, while 31% believe that waste exceeds 50%. Only 6% of the respondents believe they are not wasting any cloud spend. The FinOps Mindset: Your Financial Control Panel Fixing this level of cloud waste requires more than a one-time audit. It requires a cultural shift known as FinOps , i.e., the practice of bringing financial accountability to the variable spend model of the cloud. It is a collaborative effort where finance, technology, and business teams work together to make data-driven spending decisions. A FinOps strategy turns cloud cost from a static IT expense into a dynamic, managed business variable. The goal is not to minimise cost at all costs, but to maximise business value from every cloud dollar spent. Gaining Visibility: The Non-Negotiable First Step You can’t manage what you don’t measure, so start with the native tools your cloud provider offers. Explore their cost management consoles and take these steps to create accountability and track what’s driving expenses: Use tagging consistently to make filtering, organising, and tracking costs easier. Assign every resource to a project, department, and owner. Consider third-party cloud cost optimisation tools for deeper insights. They can automatically spot waste, recommend right-sizing actions, and consolidate data into a single dashboard if you’re using multiple cloud providers. Implementing Practical Optimisation Tactics Once you have visibility, you can act, and the easiest place to start is with the low-hanging fruit. For example: Automatically schedule non-production environments like development and testing to turn off during nights and weekends. Implement storage lifecycle policies to move old data to lower-cost archival tiers or delete it after a set period. Adjust the size of your servers by checking how much they are actually used. If the CPU is used less than 20% of the time, the server is larger than necessary, replace it with a smaller, more affordable option. Leveraging Commitments for Strategic Savings Cloud providers offer substantial discounts, like AWS Savings Plans or Azure Reserved Instances, when you commit to using a consistent level of resources for one to three years. For predictable workloads, these commitments are the most effective way to reduce unnecessary spending at full list price. The key is to make these purchases after you have right-sized your environment. Committing to an oversized instance just locks in waste. Optimise first, then commit. Making Optimisation a Continuous Cycle Managing cloud costs is not a one-time project, it’s an ongoing cycle of learning, optimising, and operating. Set up regular check-ins, monthly or quarterly, where stakeholders review cloud spending against budgets and business goals. Give your teams access to their own cost data. When developers can see the real-time impact of their architectural decisions, they become strong partners in reducing waste. Scale Smarter, Not Just Bigger The cloud offers elastic efficiency, but managing waste ensures you capture that benefit fully. It frees up capital to invest in your real business goals instead of letting it disappear into unnecessary cloud spend. As you plan for growth in 2026, make cost intelligence a core part of your strategy. Use data to guide provisioning decisions and set up automated controls to prevent waste before it starts. Reach out today for a cloud waste assessment, and we’ll help you build a sustainable FinOps practice. Article FAQ What is the most common type of cloud waste? The most common type of cloud waste is idle or underutilised compute resources, such as virtual machines, containers, or databases, that are running but not actively serving a meaningful workload, often left on accidentally or “just in case.” Can cloud waste really make a big difference to my bottom line? Absolutely. Industry reports consistently show that enterprises waste an average of 30% of their cloud spend. For a growing small business, reclaiming even 15–20% of your cloud bill can translate to thousands of dollars annually for reinvestment. Are reserved instances always the right choice to save money? They are excellent for stable, predictable workloads running 24/7. However, they are not ideal for spiky, experimental, or short-term projects. The key is to analyse your usage patterns for at least a month before making a commitment. Is automating shutdowns safe for my production systems? Automation should be applied cautiously to production. Focus initial automation efforts on non-production environments (development, testing, staging). For production, use scaling policies that automatically add/remove capacity based on real-time demand (like auto-scaling groups), which is safer than blanket shutdowns.
AI chatbots can answer questions. But now picture an AI that goes further, updating your CRM, booking appointments, and sending emails automatically. This isn’t some far-off future. It’s where things are headed in 2026 and beyond, as AI shifts from reactive tools to proactive, autonomous agents. This next wave of AI is called “Agentic AI.” It describes AI that can set a goal, figure out the steps, use the right tools, and get the job done on its own. For a small business, that could mean an AI that takes an invoice from inbox to paid, or one that runs your whole social media presence. The upside is massive efficiency, but it also means you need to be prepared. When AI gets more powerful, having the right controls matters just as much. What Makes an AI “Agentic”? Think of the difference between a tool and an employee. A chatbot is a tool you use to help you with tasks while you stay in control. An AI agent, on the other hand, is more like a digital employee you give direction to. It has access to systems, can make decisions with set boundaries, and learns from outcomes. A research article on the evolution and architecture of AI agents explains the big shift like this: AI is moving from tools that wait for instructions to systems that work toward goals on their own. Instead of just helping with tasks, AI starts doing the work, making it possible to hand off whole processes and collaborate with it like a teammate. The 2026 Opportunity for Your Business For small businesses, this is about real leverage. Agentic AI can work around the clock, clear out repetitive bottlenecks, and cut down errors in routine processes. That means things like personalising customer experiences at scale or even adjusting supply chains in real time become possible. And this isn’t about replacing your team. It’s about leveling them up. AI takes the busywork so your people can focus on strategy, creativity, tough problems, and relationships, the things humans do best. Your role shifts too, from doing everything yourself to guiding and supervising your AI. What You Need Before You Launch Agentic AI Before you hand over your processes to an AI agent, you need to make sure those processes are rock solid. The reasoning is simple: AI will amplify whatever it touches, order or chaos, with equal efficiency. That’s why preparation is key. Start with this checklist: 1. Clean and Organise Your Data: AI agents make decisions based on the data you give them. Garbage in means not just garbage out, it can lead to major errors. Audit your critical data sources first. 2. Document Workflows Clearly: If a human can’t follow a process step by step, an AI won’t be able to either. Map out each workflow in detail before you automate. Building Your Governance Framework Just like with human team members, delegating to an AI agent requires oversight. That means setting up clear guardrails by asking a few key questions: What decisions can the AI agent make on its own? When does it need human approval or guidance? What are its spending limits if it handles finances? Which data sources is it allowed to access? Answering these questions lets you build a framework that becomes your company’s rulebook for its “digital employees.” Security is another critical piece. Every AI agent needs strict access controls, following the principle of least privilege. Just as you wouldn’t give an intern full access to the company bank account, you must carefully define which systems and data each agent can touch. Regular audits of agent activity are now a non-negotiable part of good IT hygiene. Start Preparing Your Business Today You don’t have to deploy an AI agent immediately, but you can start laying the groundwork today. Start by identifying three to five repetitive, rules-based workflows in your business and document them in detail. Then, clean up and centralise the data those workflows rely on. Try experimenting with existing automation tools as a stepping stone. Platforms that connect your apps, like Zapier or Make, let you practice designing triggered, multi-step actions. Thinking this way is the perfect training ground for an agentic AI future. Embracing the Role of Strategic Supervisor The businesses that will thrive are the ones that learn to manage a blended workforce of humans and AI agents. Research from Stanford University suggests that key human skills are shifting, from information-processing to organisational and interpersonal abilities. In a world with agentic AI, leadership means setting agent goals, defining ethical boundaries, providing creative direction, and interpreting outcomes. Agentic AI is a true force multiplier, but it depends on clean data and well-defined processes. It rewards careful preparation and punishes the hasty. By focusing on data integrity and process clarity now, you position your business not just to adapt, but to lead. Contact us today for a technology consultation on AI integration. We can help you audit workflows and create a roadmap for reliable, effective adoption. Article FAQ What is a simple example of Agentic AI in a small business? A good example is an AI agent that monitors inventory levels. For example, when stocks run low, it contacts pre-approved suppliers, negotiates prices based on preset limits, and places a purchase order, all autonomously. Are AI agents expensive to implement for small businesses? Not necessarily. Most AI agents operate on a subscription model, and there are many open-source solutions that you can self-host and run locally. Ideally, the larger cost is not the technology, but investing in preparing your data and workflows for use by the AI agent. What is the biggest risk of using autonomous AI agents? The biggest risk is “unchecked autonomy,” which leads to automation chaos. Basically, implementing an AI agent without clear limits, oversight, and audit logs could lead to financial loss, reputational damage, and security breaches if the agent makes erroneous decisions or is manipulated.
The modern office extends far beyond traditional cubicles or open-plan spaces. Since the concept of remote work became popularised in the COVID and post-COVID era, employees now find themselves working from their homes, libraries, bustling coffee shops, and even vacation destinations. These environments, often called “ third places ,” offer flexibility and convenience but can also introduce risks to company IT systems. With remote work now a permanent reality, businesses must adapt their security policies accordingly. A coffee shop cannot be treated like a secure office, as its open environment exposes different types of threats. Employees need clear guidance on how to stay safe and protect company data. Neglecting security on public Wi-Fi can have serious consequences, as hackers often target these locations to exploit remote workers. Equip your team with the right knowledge and tools, and enforce a robust external network security policy to keep company data safe. The Dangers of Open Networks Free internet access is a major draw for remote workers frequenting cafes, malls, libraries, and coworking spaces. However, these networks rarely have encryption or strong security, and even when they do, they lack the specific controls that would be present in a secure company network. This makes it easy for cybercriminals to intercept network traffic and steal passwords or sensitive emails in a matter of seconds. Attackers often set up fake networks that look legitimate. They might give them names such as “Free Wi-Fi” or give them a name resembling a nearby business, such as a coffee shop or café, to trick users. Once connected, the hacker who controls the network sees everything the employee sends. This is a classic “man-in-the-middle” attack. It is critical to advise employees never to rely on open connections. Networks that require a password may still be widely shared, posing significant risks to business data. Exercise caution at all times when accessing public networks. Mandating Virtual Private Networks The most effective tool for remote security is a VPN. A Virtual Private Network encrypts all data leaving the laptop by creating a secure tunnel through the unsecured public internet. This makes the data unreadable to anyone trying to snoop. Providing a VPN is essential for remote work, and employees should be required to use it whenever they are outside the office. Ensure the software is easy to launch and operate, as overly complex tools may be ignored. Whenever possible, configure the VPN to connect automatically on employee devices, eliminating human error and ensuring continuous protection. At the same time, enforce mandatory VPN usage by implementing technical controls that prevent employees from bypassing the connection when accessing company servers. The Risk of Visual Hacking Digital threats are not the only concern in public spaces since someone sitting at the next table can easily glance at a screen. Visual hacking involves stealing information just by looking over a shoulder, which makes it low-tech but highly effective and hard to trace. Employees often forget how visible their screens are to passers-by, and in a crowded room full of prying eyes, sensitive client data, financial spreadsheets, and product designs are at risk of being viewed and even covertly photographed by malicious actors. To address this physical security gap, issue privacy screens to all employees who work remotely. Privacy screens are filters that make laptop and monitor screens appear black from the side, and only the person sitting directly in front can see the content. Some devices come with built-in hardware privacy screens that obscure content so that it cannot be viewed from an angle. Physical Security of Devices Leaving a laptop unattended is a recipe for theft. In a secure office, you might walk away to get water or even leave the office and expect to find your device in the same place, untouched. In a coffee shop, that same action can cost you a device, since thieves are always scanning for distracted victims and are quick to act. Your remote work policy should stress the importance of physical device security. Employees must keep their laptops with them at all times and never entrust them to strangers. A laptop can be stolen and its data accessed in just seconds. Encourage employees to use cable locks, particularly if they plan to remain in one location for an extended period. While not fool proof, locks serve as a deterrent, especially in coworking spaces where some level of security is expected. The goal is to make theft more difficult, and staying aware of the surroundings helps employees assess potential risks. Handling Phone Calls and Conversations Coffee shops can be noisy, but conversations still travel through the air. Discussing confidential business matters in public is risky, as you never know who might be listening. Competitors or malicious actors could easily overhear sensitive information. Employees should avoid discussing sensitive matters in these “third places.” If a call is necessary, they should step outside or move to a private space, such as a car. While headphones prevent others from hearing the other side, the employee’s own voice can still be overheard. Creating a Clear Remote Work Policy Employees shouldn’t have to guess the rules. A written policy clarifies expectations, sets standards, and supports training and enforcement. Include dedicated sections on public Wi-Fi and physical security, and explain the reasoning behind each rule so employees understand their importance. Make sure the policy is easily accessible on the company intranet. Most importantly, review this policy annually as technology changes. As new threats emerge, your guidelines must also evolve to counter them. Make routine updates to the policy, and reissue the revised versions to keep the conversation about security alive and ongoing. Empower Your Remote Teams While working from a “third place” offers flexibility and a morale boost, it also requires a higher level of vigilance. This makes prioritising public Wi-Fi security and physical awareness non-negotiable, and you must equip your team to work safely from anywhere. With the right tools and policies, you can manage the risks while enjoying the benefits of remote work. Success comes from balancing freedom with responsibility, and well-informed employees serve as your strongest line of defence. Protect your data, no matter where your team works. Is your team working remotely without a safety net? We help businesses implement secure remote access solutions and policies, ensuring your data stays private, even on public networks. Call us today to fortify your remote workforce.