This year’s uncomfortable truth about people and cyber

Dear renegades, mavericks, and deviants,

It’s been a bit of a year, hasn’t it?

Everywhere I go, I hear the same two stories at once:

AI is exploding across the business, and yet the basics still trip people up.

All the while, leaders want evidence that risk is going down, and you want to show it.

That’s why we work with the National Cybersecurity Alliance to produce the Oh, Behave! research report each year, so we all have more than just anecdotes. It’s a global study of 7,000 people that tracks real attitudes and behaviors across AI use, verification, passwords, MFA, and so much more.

Here are a few headlines:

57% are always connected, which stretches attention and skews online choices.
45% now find staying secure confusing (up from 36% last year). The tools multiply, but the brain does not.
89% of Gen Z and 79% of Millennials use AI, yet 52% of workers report no training on the risks.
44% lost money or data to scams this year; among those who answered a deepfake call, 42% suffered a loss.
Reporting is high (91%), but exposure-reducing behaviors still vary widely across teams and ages.

You know the pattern as well as I do. Adoption races ahead while habits lag. Controls focus on activity, not outcomes. Boards ask for the line that proves risk went down.

Which means you need something better than a completion rate.

And this report has it. It gives you a clear picture of what people actually do, where confidence outstrips capability, and which behaviors to move first.

Get the report

If you want help turning insights into strategy, book a call with me and we’ll get stuck in.

— Oz A