More than four in five workers across 14 professional groups have experienced cybersecurity incidents, yet relatively few adopt additional security measures after an attack, according to a global survey by Kaspersky, highlighting a gap between exposure to online threats and efforts to prevent them.
The study, conducted by Kaspersky’s market research centre in March 2026 among 7,200 respondents across 18 countries, found that reported cybersecurity incident rates ranged from 82 per cent among workers in administration and business support roles to 89.7 per cent among those in corporate risk, legal and compliance positions.
Despite the widespread exposure, respondents were more likely to change their online behaviour than introduce additional technical safeguards. While 44.7 per cent said they stopped answering calls from unknown numbers after experiencing an incident, only 30.1 per cent enabled multi-factor authentication, a security feature that requires users to verify their identity through an additional step when accessing an account.
Similarly, just 24.3 per cent installed protection software following an incident, while 36.5 per cent stopped visiting websites they considered untrustworthy.
The findings suggest that although people take steps to reduce their exposure to suspicious online activity, these responses do not always extend to strengthening the security of their accounts and devices.
This distinction is important as cybercriminals employ different methods to target individuals, from fraudulent calls and messages to malware, identity theft and attempts to gain control of online accounts.
Fraudulent calls and SMS were the most commonly reported incidents in the survey, affecting 40.9 per cent of respondents, closely followed by spam at 40.4 per cent. Unwanted advertising accounted for 25.5 per cent.
However, respondents expressed greater concern about threats that could compromise their personal information and digital identities. Data leakage topped the list of cybersecurity concerns at 45.6 per cent, followed by social media account hacking at 44.6 per cent and personal data theft at 38.1 per cent.
The difference between the incidents people encounter most frequently and the threats they fear most points to the broader concerns surrounding the security of personal information and control over digital accounts.
Technical knowledge offers no guarantee
The survey also found that workers in technical roles continued to experience cybersecurity incidents despite their familiarity with digital systems.
Respondents in technical positions, including IT security, IT support and software development, recorded an overall incident rate of 86 per cent, compared with 84.1 per cent among those in non-technical roles.
While technical respondents reported fewer encounters with fraudulent calls and spam, they were more likely to report certain sophisticated threats.
Malware incidents were reported by 11.3 per cent of technical respondents, compared with 8.5 per cent of non-technical respondents. AI-driven fraud or deepfakes affected 9 per cent of technical respondents, against 6.3 per cent among their non-technical counterparts, while smart-device attacks were reported by 6.8 per cent and 4.1 per cent, respectively.
IT security professionals recorded an incident rate of 85.6 per cent, underscoring that technical knowledge does not necessarily eliminate exposure to cyber threats.
Workers in corporate risk, legal and compliance roles recorded the highest incident rate, at 89.7 per cent. Meanwhile, respondents in marketing-related positions reported the highest average number of distinct incident types, at 4.57, compared with the overall average of 3.72.
Marketing professionals also reported adopting several protective measures after incidents. About 42.4 per cent said they avoided using public Wi-Fi for transactions, compared with 24.1 per cent of respondents overall. Another 41 per cent said they changed their passwords more frequently, while 33.1 per cent backed up their data, against the overall average of 23 per cent.
These differences indicate that responses to cybersecurity incidents vary across professions, although the survey does not establish whether the measures adopted were sufficient to prevent subsequent attacks.
Vladimir Dashchenko, cybersecurity expert at Kaspersky, said the threats faced by individuals differ according to their work and everyday digital activities, requiring security habits and protection measures to reflect those differences.
“…there’s no single way to stay safe online, the right habits and the right protection depend on how people actually live and work. Marketing professionals, compliance specialists, IT experts and everyone in between face a different mix of risks, so cybersecurity habits and protection measures need to adapt to the specifics of each person’s work and daily habits, rather than expecting everyone to be equally vigilant about everything,” he said.
Dashchenko added that the growing diversity of scams, including those powered by artificial intelligence, made it important to combine appropriate online behaviour with protection that could operate automatically across devices.
Kaspersky recommends enabling multi-factor authentication wherever available, avoiding the reuse of passwords across accounts, keeping devices and software updated, and using password managers to protect login credentials.
The company also advises users to adopt security solutions that provide protection across their devices rather than relying solely on their ability to identify suspicious activity.
