Oh, Behave! 2026 Report: AI Moved in, Guardrails Didn't

Every fall, the U.S.-based National Cybersecurity Alliance (NCA) and CybSafe take the public's temperature on security, and every year the diagnosis rhymes: people know what to do, and then they don't do it.

The sixth annual "Oh, Behave! The Annual Cybersecurity Attitudes and Behaviors Report 2026–2027" keeps that throughline, but this edition has a sharper edge. AI is now everywhere, at home and at work, and employers have pushed adoption much faster than they've built the governance to go with it. Meanwhile, half of all respondents say they have already been victims of cybercrime.

This year's survey covered 5,000 adults across five countries—the United States, United Kingdom, India, Brazil, and Singapore (new this year—and fielded April 28 to May 19, 2026. For the first time, NCA and CybSafe also worked with Dr. Lorrie Faith Cranor and her team at Carnegie Mellon University's CyLab to redesign the survey. That collaboration added 19 new questions, mostly on AI and authentication, and four new scam categories.

The partners released two versions: a full 180-page research report and a condensed Business Edition aimed at security and awareness leaders. This breakdown draws on both.

A note on comparisons: Last year's report (our 2025 coverage is here) surveyed 7,000 people across seven countries, including Germany, Australia, and Mexico, which were dropped this year. The report's year-over-year figures compare only countries and questions that appear in both years, and the changes cited below are the report's own.

The headline: confidence outruns behavior

On paper, attitudes look healthy. Eighty-three percent of respondents call online security a top priority, 77% say it's worth the effort, and 70% believe it's achievable. The share who feel security is under their control rose three points to 61%.

Underneath those numbers, the old habits are still there:

• 50% assume their devices are automatically secure.

• 55% believe proper protection is too expensive, up two points.

• 73% say they know how to create a strong password and do so. Yet 46% use dictionary words, and 38% use personal information in their passwords.

• 60% reuse or slightly modify a familiar password when they're in a hurry. Only 25% create passwords longer than 12 characters.

In their foreword, CybSafe CEO Oz Alashe and NCA Executive Director Lisa Plaggemier call this "the stubborn persistence of the knowing/doing gap." People know the rules, they write, "but convenience wins (nearly) every time."

AI: mass adoption, minimal training

This is the report's biggest story, and the biggest change from last year.

Eighty percent of respondents now use AI tools, up from 65% in last year's report. Half (50%) use AI at work. Usage is close to universal among younger adults: 92% of Millennials and 90% of Gen Z use AI, compared with 52% of Baby Boomers.

Employers are a big part of the push. Forty-four percent of workplace AI users started because their employer required or encouraged it, slightly more than the 41% who started on their own. But the training hasn't followed:

• 56% of all AI users, and 52% of employed AI users, have received no training on AI security or privacy risks.

• 43% of workplace AI users say their company's guidance on what not to share with AI is missing or unclear.

• 32% of workplace AI users admit to sharing sensitive company information with AI tools without their employer's knowledge, and another 4% aren't sure. Most often they shared internal documents or customer data (50%) and financial data (47%).

That 32% is lower than the 43% reported in last year's edition. With a different country mix and redesigned questions, though, it isn't a clean like-for-like comparison, and the report doesn't present it as an improvement.

Younger workers lead on shadow AI too: 40% of Gen Z and 35% of Millennials admit to unsanctioned sharing, compared with 17% of Baby Boomers. In Brazil, the figure reaches 46%, the highest of any country; Singapore is lowest at 23%.

The oversharing extends to personal life. Forty percent of AI users have shared health information with a chatbot, 32% have shared feelings they'd normally reserve for someone close, and 18% have told an AI a secret they've never told another person. All of this while 67% say they worry about AI-driven cybercrime.

The report's recommendation isn't a ban, which it says would fail anyway. It calls for "controlled enablement" built on AI tool registries, role-specific guidance, and internal audits. The Business Edition puts the practical version this way: go past policy acknowledgment and give people concrete examples of what's okay to share and what isn't.

Victimization hits half the sample

Fifty percent of participants have been personal victims of cybercrime, up six points from 2025. That adds up to 5,662 incidents across the sample.

• Phishing is still the most common incident type (16%). Job scams, identity theft, and online marketplace scams tie for second at 12% each. The latter two categories are new to the survey this year.

• Growing up online doesn't protect anyone. Sixty-four percent of Gen Z and 57% of Millennials have lost money or data to scams, compared with 33% of Baby Boomers and 23% of the Silent Generation.

• Deepfake calls are now common. Thirty-six percent of all respondents have received a deepfake phone or video call (up two points), and 40% of those lost money or data. Targeting peaks among Millennials (48%) and Gen Z (42%).

• The U.S. leads in identity theft, with 30% of victims, but held up better against deepfakes: 39% were targeted, and only 28% of those lost money or data.

Fatalism is also widespread. Thirty-nine percent consider data theft an unavoidable cost of being online, and 33% feel the same about losing money. More respondents fear becoming a victim (66%) than expect it (37%). On the defenders' side, there's a small improvement: the share who believe attackers are more advanced than defenders fell six points to 63%, and doubts about law enforcement's capacity fell seven points to 57%.

Reporting is mixed. Eighty-nine percent of incidents were reported somewhere, most often to a bank or card issuer. Reports to police ranged from only 27% to 41% depending on the crime type. Those who didn't report most often said the loss was too small, they didn't know who to contact, or they were embarrassed.

Training works for the people who get it

For the security awareness community, the training data offer both good and bad news.

The good news: training works when people take it. Eighty-eight percent of attendees found it useful (up five points). Fifty-four percent got better at spotting and reporting phishing, 49% started using MFA, and 46% adopted a password manager. Each of those behavior figures rose by seven to eight points from 2025.

The bad news is access. Half of all respondents (50%) have no access to cybersecurity training, although that's a five-point improvement. Access is concentrated in IT (76%) and finance (75%), while 58% of hospitality workers have none. Fewer than half of working respondents (47%) have any mandatory training, and in the U.S., 55% of employed participants aren't required to complete any.

One generational finding stands out. Training access and usage rose for every generation this year except Gen Z, which fell eight points. Gen Z also has the highest victimization rate and is the most likely generation to skip training when it's offered (21%).

The reasons people give for skipping are revealing: lack of time (21%), feeling they already know enough (19%, up three points), and, tied at 17%, doubting that training reduces their risk or not seeing security as a priority.

On format, video is the most preferred (50%). Bite-sized, in-the-moment nudges rose six points to 34%, tying written materials for third place for the first time. The Silent Generation is the exception and still prefers written content.

MFA rises, passkeys lag

There's real progress on authentication. Regular multi-factor authorization (MFA) use rose six points to 47%, the first increase the report has recorded since 2022. The share who have never heard of MFA dropped six points to 17%. Media coverage seems to help: among people who took action after a news story, 57% enabled MFA, a nine-point jump.

Still, 53% don't use MFA regularly, including 21% who know how and choose not to. Password managers barely register as a storage method. 28% keep passwords in a paper notebook and 23% rely on memory, while only 11% use a password manager app. The U.S. leads in notebook storage at 35%.

Passkeys show the same knowing/doing gap. Seventy percent of respondents are at least somewhat familiar with them, but only 39% use them. Among people who don't use biometrics, the main barrier is privacy rather than confusion: 33% cite concerns about sharing biometric data. As one U.S. respondent put it, biometrics, unlike a password, "cannot be changed if it is hacked or stolen."

Confidence also doesn't match behavior. Sixty-four percent feel confident spotting a phishing email and 71% a scam text, yet only 61% regularly check messages for warning signs and just 41% report suspicious messages.

At work, culture indicators look solid. Sixty percent say leadership visibly champions cybersecurity, and 64% say secure habits are built into daily routines. But 48% still view their own colleagues as a security risk, almost unchanged from 49% last year. Millennials are the most wary, at 53%.

Responsibility for workplace data is landing on IT (43%) and security teams (38%). Individual employees come third at 36%. Expectations that government will play a role rose for both personal and workplace data.

Trust in government cuts both ways, though. Fifty-seven percent worry about their own government accessing their data through apps, close to the 58% who worry about foreign governments doing the same.

Drawing on the report's recommendations and the Business Edition's practitioner guidance:

• Treat shadow AI as a governance gap, not a discipline problem. When employers require AI use but 43% of users lack clear guidance, unsanctioned data sharing is predictable. Publish approved tools, give concrete examples of what's okay to share and what isn't, and train people on AI risk specifically.

• Rethink the "digital native" assumption. Gen Z and Millennials are the most confident, most targeted, and most victimized groups. Build deepfake and scam awareness content for younger employees in formats and language that will hold their attention.

• Make training short, relevant, and well timed. Lack of time and overconfidence are the top reasons people skip it. Microlearning, real job examples, and employee success stories work better than an annual hour-long module.

• Close the access gap. Half the sample has no training at all, and the gaps are widest in frontline industries like hospitality.

• Watch your language. The Business Edition notes that fear-based words like "threats" and "attacks" can make people more frustrated and intimidated and more likely to disengage.

• Reduce friction on the controls that matter. MFA is finally rising. Push passkeys and password managers, and address biometric privacy concerns directly.

• Share wins. Stories about scams employees caught can build a stronger culture than more warnings.

As Alashe and Plaggemier put it in this year's foreword: "People aren't the problem. They never have been. They're just… human." The data show plenty of people want to do the right thing. The job for security leaders is to make the secure choice easy to take.

• 80% use AI tools (65% in the 2025 report); 50% use AI at work.

• 56% of AI users have had no AI security or privacy training.

• 32% of workplace AI users have shared sensitive company data without their employer's knowledge.

• 50% have been cybercrime victims, up six points from 2025.

• 64% of Gen Z have lost money or data to scams, versus 33% of Baby Boomers.

• 36% have received a deepfake call; 40% of them lost money or data.

• 50% have no access to cybersecurity training; 88% of those who took it found it useful.

• 47% use MFA regularly, up six points and the first increase since 2022.

• 39% use passkeys, despite 70% familiarity.

• 48% see their own colleagues as a security risk.