EU Cybersecurity Survey Highlights a Workplace Deepfake Detection Gap as AI Scams Rise

Three in four EU employees said they encountered suspicious messages, links or other cyber threats at work during the previous six months, according to Flash Eurobarometer 576. The survey also points to a difficult mismatch for employers: 83% believe a cyberattack would have serious consequences for their organisation, but only 48% say they can recognise an AI-generated fake video.

The findings, released by the European Commission and ENISA as European Cybersecurity Month 2026 began, show that awareness of cyber risk does not automatically translate into confidence with newer forms of impersonation. For businesses, the practical issue is not simply whether staff know that phishing exists. It is whether everyday processes help people pause, verify unusual requests and escalate concerns before an attacker gains access to data, accounts or payments.

The European Commission's report on the workplace cybersecurity survey is based on an online survey of 25,747 EU citizens across all 27 Member States, conducted from 27 April to 8 May 2026. The results were published on 30 September 2026. They represent respondents' reported experiences and perceptions, rather than a count of confirmed cyber breaches.

What the EU survey found about workplace threats

Phishing was the most commonly reported threat. Thirty-nine percent of respondents said they had encountered it in the preceding six months. Attempts to obtain personal data, malware and password theft also featured prominently. Importantly, 15% reported AI-generated or AI-enabled scams, placing AI-assisted deception among the threats employees say they are already seeing.

The data should not be read as evidence that each respondent's organisation suffered an attack. For example, 18% said no incidents had occurred as far as they were aware. Still, the frequency of reported suspicious activity matters because phishing, stolen credentials and impersonation attempts often depend on a hurried or uncertain human decision.

The survey also suggests that organisations cannot assume employees feel fully prepared. Sixty percent said they had received cybersecurity training in the prior year, while 85% said they wanted to improve their skills. Around 60% believed their organisation had some key cybersecurity measures in place, and roughly a quarter said their organisation planned to adopt them.

For a smaller company without a large security team, these figures underline the value of making security habits practical and repeatable. A training session alone may not address a convincing voice, video or message that appears to come from a colleague, supplier or senior manager.

Turning awareness into safer everyday decisions

Deepfake video recognition is only one part of the challenge. A fake video can be used to add credibility to a fraudulent request, but the decision point may still be an email, chat message, phone call or payment instruction. Businesses can focus on the situations in which an employee is asked to act quickly, share information or change account details.

Useful measures to prioritise include:

• Create a verification step for sensitive requests, particularly payment changes, credential requests and requests for confidential information.
• Use a known contact method to confirm unusual instructions, rather than replying through the channel that delivered the request.
• Train with realistic examples of phishing and AI-enabled impersonation, so staff practise identifying urgency, unexpected links and requests that bypass normal procedures.
• Make reporting simple and non-punitive, giving employees a clear route to flag a suspicious message or interaction promptly.
• Review which staff roles face the most targeted requests, including finance, customer support, HR and people who manage supplier relationships.

These practices do not require employees to become forensic experts in manipulated media. They create a second check around decisions that could expose an organisation to loss or compromise. That distinction is important when reliable visual detection is difficult and AI can make impersonation more convincing.

The findings arrive in the context of EU cyber policy developments including the NIS2 Directive and the Cyber Resilience Act. The survey itself is most useful as a snapshot of employee awareness and preparedness: people broadly understand the stakes, but many do not yet feel confident identifying a key form of AI-enabled deception.

AI-enabled impersonation makes everyday workflows, not just security tools, part of a company's risk surface. Scalevise helps businesses identify practical AI use cases and implement them around real operating processes, including the checks and handoffs that matter most. A focused AI implementation consultation can help your team assess where AI adoption and existing processes need clearer safeguards, less manual friction and stronger verification. Request an AI consultation to map the next practical steps.

Frequently Asked Questions

What is Flash Eurobarometer 576?

Flash Eurobarometer 576 is an EU survey titled "Cybersecurity at the workplace: awareness and preparedness among employees." It surveyed 25,747 EU citizens across all 27 Member States from 27 April to 8 May 2026, with results published on 30 September 2026.

How many EU employees reported workplace cyber threats?

Seventy-five percent reported encountering suspicious messages, links or other cyber threats at work in the previous six months. This is self-reported survey data, not a measure of confirmed breaches.

What was the most common cyber threat reported in the survey?

Phishing was the most commonly reported threat, cited by 39% of respondents. Attempts to obtain personal data were reported by 18%, malware by 17% and password theft by 16%.

Can employees recognise AI-generated fake videos?

Forty-eight percent of respondents said they could recognise an AI-generated fake video. The result indicates that more than half did not say they had that ability.

What can businesses do about AI-enabled impersonation?

Businesses can establish clear verification steps for sensitive requests, train staff on realistic scam patterns, provide easy reporting routes and confirm unusual instructions through a known contact method.

Conclusion

The EU survey shows that workplace cyber threats are already a routine experience for many employees, while confidence in spotting AI-generated fake video remains limited. Businesses should treat the gap as an operational issue: build verification and reporting habits into the moments when staff handle money, credentials, data and urgent requests.