The News
The National Cybersecurity Alliance (NCA) and CybSafe have released the sixth annual Oh, Behave! Cybersecurity Attitudes and Behaviors Report 2026–2027, drawing on a survey of 5,000 adults across the U.S., U.K., India, Brazil, and Singapore. The report finds that awareness of cybersecurity risk is at an all-time high, with 81% of U.S. adults calling online security a priority and 58% expressing fear of becoming a cybercrime victim. The central finding, however, is a persistent gap between that awareness and the behavioral changes needed to act on it, a gap the report argues is closable through targeted training, clearer workplace policy, and better habit formation.
Analyst Take
The Awareness Surplus Nobody Planned For
Most cybersecurity communications campaigns are designed to raise awareness. The inconvenient finding from this year’s Oh, Behave! data is that awareness is no longer the problem. Eight in ten U.S. adults already consider staying secure online a priority. What’s broken is the translation layer: the organizational infrastructure, workplace policies, and behavioral scaffolding that convert concern into consistent action. That’s a different problem, and it demands a different solution set than what most enterprise security awareness vendors currently sell.
The report’s training effectiveness numbers make this tension concrete. Among those who actually received cybersecurity training, 88% found it useful, and the downstream behavior changes are measurable: 54% improved at spotting phishing, 49% set up MFA, and 46% adopted a password manager. Those are strong outcomes. The problem is coverage. More than half of employed Americans face no mandatory training at their workplace. That’s not a content quality problem. It’s a deployment and governance failure.
The AI Shadow Policy Problem
According to the report, eighty percent of respondents now use AI in some form, but 56% of AI users have received zero security or privacy training related to it. Nearly a third of workplace AI users have shared sensitive company information with an AI tool without employer knowledge, and 43% of those users say their employer simply never told them what was appropriate to share. This isn’t reckless behavior. It’s a policy vacuum being filled by individual judgment.
This dynamic maps directly onto what ECI Research is observing in the public sector technology market. According to ECI Research’s Google GovTech Survey, 31.8% of respondents cited “FedRAMP/compliance approval friction for AI vendors” as the single largest blocker preventing widespread AI adoption in developer workflows. The friction that frustrates IT leadership at the procurement level has a direct parallel on the end-user side: people are adopting AI tools faster than governance frameworks can keep up, whether those users are developers pushing code or knowledge workers summarizing meetings. The governance gap is not a niche DevSecOps concern. It spans the entire workforce.
For ITDMs, the business exposure here is straightforward. Sensitive company data is moving into external AI tools without authorization, not because employees are malicious, but because no one drew a clear line. The cost of establishing AI use policies is low. The cost of a data exposure incident traced back to an undocumented AI workflow is not.
Who Wins and Who Needs to Move
The behavioral risk platform category, where CybSafe competes, is positioned well by this report’s conclusions. The argument that “measuring what people know” is less valuable than “measuring what behaviors are actually changing” is a direct product positioning claim, and it’s one the data supports. Vendors selling static annual compliance training face a credibility problem when 55% of American employees aren’t even getting that much, and the vendors who do reach them are producing measurable behavior change. The market is moving toward continuous, context-aware nudging rather than checkbox-driven LMS completion rates.
The Gen Z finding adds urgency to this shift. With 64% of Gen Z respondents having lost money or data to scams, the highest victimization rate of any generation, the most digitally fluent cohort is also the most exposed. They prefer video-based training (54%), followed by periodic online courses and short-form content. That preference profile is incompatible with a 45-minute annual SCORM module. Security training vendors that haven’t rebuilt their delivery formats for short-form, mobile-first consumption are designing for an audience that no longer exists in the workforce.
ECI Research’s Google GovTech Survey data adds a related dimension for enterprise and government buyers. The survey found that 48.0% of respondents selected “Navigating compliance documentation and audit evidence collection” as the greatest source of cognitive load for developers today. When the people responsible for building secure systems are already overwhelmed by compliance overhead, adding poorly designed security awareness training to their queue compounds the problem rather than solving it. The implication for security training vendors is that format and cognitive load matter as much as content accuracy.
Looking Ahead
The Oh, Behave! report positions the NCA and CybSafe well ahead of Cybersecurity Awareness Month, but its real significance is longer-term. The finding that awareness is high and training demonstrably works, combined with the finding that most people aren’t getting it, describes a large, addressable market gap. Expect the behavioral risk platform category to attract increased venture and strategic investment over the next 12–18 months as enterprise buyers begin treating security behavior data as an operational metric rather than a compliance artifact. The vendors that can connect behavior change signals to measurable risk reduction, expressed in financial terms, will win the budget conversation.
The AI governance thread will define the next two to three years of this market. Right now, most organizations are discovering their AI use policies retroactively, after employees have already established habits. The window to set norms proactively is closing fast. Organizations that move quickly to establish clear, practical AI use guidelines, and train to those guidelines rather than simply publishing a policy document, will build a structural security advantage over peers still waiting for a regulatory mandate to act. The NCA’s call for employers to invest in AI-specific training is not aspirational. It’s the minimum viable response to a workforce that has already moved.
Stay Ahead of Application Development Trends
Get weekly analyst insights, research notes, event coverage, and AppDevANGLE updates delivered directly to your inbox.
Subscribe for Weekly Insights
Join technology leaders, practitioners, and GTM teams following the trends shaping modern software delivery.
Looking for deeper research access?
Explore ECI Research reports, survey insights, and market analysis through the ECI Research Portal.
