Three in Four EU Employees Face Cyber Threats at Work: Phishing Remains the Leading Risk
What the New Survey Shows
The European Commission has published a new Eurobarometer survey showing that three in four employees across the European Union have encountered cyber threats at work.
Suspicious emails, messages and links remain among the most common situations employees face. Phishing continues to be the leading threat, followed by attempts to steal personal information and account credentials.
The findings come as Europe marks Cybersecurity Month and once again place the human element at the center of cyber defense.
Why This Matters for Business
Many modern attacks do not begin with a sophisticated technical exploit.
They often begin with:
- a fraudulent message;
- a fake login page;
- an account verification request;
- a false invoice;
- impersonation of a colleague or executive;
- an account recovery scam.
Once attackers gain credentials or an active session, phishing can develop into mailbox compromise, data theft or follow-on access to other systems.
Security awareness therefore remains important, but it cannot operate alone.
What Organizations Should Check
A practical defense model should include:
- MFA (Multi-Factor Authentication) for critical accounts;
- monitoring for unusual sign-ins and new devices;
- visibility into active sessions and tokens;
- corporate email protection;
- simple procedures for reporting suspicious messages;
- secondary verification for payment, invoice and bank-detail changes;
- regular training based on realistic attack scenarios.
Employees should be able to report suspicious activity quickly without navigating complex internal processes.
DIAMATIX Comment
From the DIAMATIX perspective, employees should not be treated simply as the “weakest link.”
They are part of the detection system.
When awareness is connected with technical controls, identity monitoring and rapid response, a single reported phishing message can help stop an attack at an early stage.
SOC (Security Operations Center) and MDR (Managed Detection and Response) add the next layer by checking whether a phishing attempt is followed by unusual sign-ins, new sessions, account changes or activity across other systems.
Effective defense does not assume that employees will never make mistakes. It is designed so that one mistake does not automatically become an incident.
Practical Takeaway
Phishing continues to work because it targets real business processes and human trust.
The stronger model is:
awareness → identity protection → monitoring → rapid response.
DIAMATIX helps organizations connect identity protection, email security and 24/7 monitoring into one detection and response process.
Request a phishing and identity risk readiness review with DIAMATIX.
Sources
- European Commission — Eurobarometer on cyber threats at work
- European Cybersecurity Month
- ENISA — Cybersecurity awareness and human risk resources
