Spotlight on Europe and the Middle East

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Spotlight on Europe and the Middle East

This year’s State of the Phish surveyed 7500 users and 1050 security professionals in 15 countries.

This summary focuses on:

France
Germany
Italy
Netherlands

Spain
Sweden
United Kingdom
United Arab Emirates

With so many languages, cultures and levels of digital maturity, there were significant variations between regions, and between the eight countries covered by this summary. The region is diverse, geographically, culturally and economically. But in at least one respect the region shows some uniformity. Users in the region were more likely to admit to taking a risky action than the global average (76% vs 71%). Yet the number of people who said they knew the action they were taking carried risk was within 1 percentage point of the global figure (95%).

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

At country level, 86% of respondents from UAE said they took a risky action. This was higher than any other country in our survey. UAE organisations also reported the highest incidence of successful spear phishing attacks, showing a strong link between user awareness and security performance. But interestingly, UAE still had the highest number of users who said that they consider security to be their responsibility (62% vs 41% global average).

Users from Sweden were the least likely to say that security is their responsibility. This aligns with the higher-than-average level of users taking risky actions (82%) in Sweden.

Security Responsibility (Europe and the Middle East)

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Security professionals in the region rated password re-use as the riskiest behaviour. Unfortunately, password re-use was the second most common behaviour among end users. But there’s some good news for security teams: accessing inappropriate websites was the only other action from their top five to also appear among the most common user behaviours.

Rank	Risky Behaviour (Ranked by Sec Pros)	Risky Behaviour (Conducted by Users)
1	Reuse or share password	Use work device for personal activities
2	Click on links or download attachments from someone I don’t know	Reuse or share password
3	Upload sensitive data to unproven 3rd party cloud	Connect without using VPN at a public place
4	Give credentials to untrustworthy source	Respond to a message (email or SMS text) from someone I don’t know
5	Access inappropriate website	Access inappropriate websites

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

But why do users take risky actions? The most common answer was “to save time,” closely followed by “convenience.” In the United Kingdom, the top two responses swapped places, with more U.K. respondents citing convenience than anyone else.

Why Users Take Risky Actions

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Users in Europe and the Middle East are clear about why they take risky actions. But what would motivate them to prioritise security? As with our global results, the majority cited making security easier as the most effective motivator, and punishment as the least motivating.