Complacent Gen Z and Millennial workers are more likely to be duped by social engineering attacks

"While most workers believe they can spot a phishing attempt, nearly one-in-four under-35s would fall for a suspicious message if they thought it came from a colleague or boss. Four-in-five British workers told Accenture researchers they were confident they'd spot a suspicious message, even though more than a third have never received cybersecurity training. Men show the biggest faith in themselves, being nearly twice as likely as women to report high confidence in spotting cyber threats, at 22% compared with 12%."

""With cyber criminals weaponizing information from social media to deceive people with realistic messages or calls, employees must make faster judgement calls on what's real and what's not," said Kamran Ikram, Accenture's security lead in the UK and Ireland. "The workforce feels cyber confident - though its uneven among men and women - there remains a serious skills and training gap across the board. Being overconfident yet undertrained is a dangerous position to be in.""

"Notably, more than one-third (37%) of British workers have never received any cybersecurity training, including 44% of over-55s. Meanwhile, only one-in-five have been trained to recognize deepfakes or AI-generated phishing emails. This lack of training is more significant in smaller companies, where 79% of microbusinesses with less than 10 employees and 55% of small firms with between 10 and 49 employees offer no cybersecurity training at all."

A large share of British workers report confidence in identifying suspicious messages, yet significant gaps in training persist. Younger employees are more likely to fall for messages that appear to come from colleagues or leaders, and men report higher self-confidence than women in spotting cyber threats. Over a third of workers have never received cybersecurity training, and only one-in-five have training to recognize deepfakes or AI-generated phishing. Smaller companies are least likely to offer training, with microbusinesses and small firms showing especially high rates of no cybersecurity education. Experts warn that overconfidence combined with limited training increases organizational risk.

Read at IT Pro