Summary: New Aware Force data from over 9,000 employee responses shows a dangerous disconnect: 85% of employees worry about AI-enabled devices, but only 19% use a password manager. This “action gap” is the real threat to your organization. Closing it requires behavior-based action, not more training.

“Your employees aren’t ignoring cybersecurity; they’re worried about it. They’re just unsure how to act”

That’s the problem.

Aware Force’s new report, Insights on Employee Cybersecurity Behavior, surveyed employees across industries and found a gap between concern and action so wide it deserves its own name: the action gap. Employees say they’re worried. Then they do nothing about it. And that gap — not ignorance, not apathy — is where your organization’s real exposure lives.

The paradox in employee cybersecurity behavior

Here’s the number that should stop every CISO mid-scroll: 85% of employees say they’re concerned about AI-enabled smart home devices, yet only nineteen percent use a password manager.

That’s not a small gap. That’s a cyber Grand Canyon.

Dig deeper, and the pattern holds. Sixty-three percent of employees worry about AI-driven cybercrime. Meanwhile, 80% use SaaS or AI tools without IT approval, and 50% use unapproved AI tools. Fifty-five percent connect personal apps to work systems. Fifty-eight percent report receiving no training at all on AI-related risks.

Nearly half of employees haven’t checked their privacy settings in recent months. One in five can’t reliably tell AI-generated content from the real thing. Fifteen percent admit they’ve already been fooled.

Employees know the risk exists. They just haven’t connected that knowledge to a specific action they can take today. That disconnect is what’s exposing your team: not a lack of concern, but a lack of a clear next step.

Why does traditional cybersecurity training fail to close the action gap?

Annual training modules were built for a different threat landscape. They check a compliance box once a year and move on. Employee behavior doesn’t follow an annual cycle — it’s shaped by daily habits, and habits change only through repetition.

The report backs this up: 50% of employees say they lack access to or don’t engage with existing training. And once-a-year check-the-box training simply isn’t built for a threat environment that shifts week to week.

Traditional training assumes a knowledge problem. The thinking goes; give employees more information and behavior will follow. The data says otherwise. Employees already know smart devices carry risk. They already know AI content can deceive them. Knowledge was never the missing piece.

How can organizations close the gap between security awareness and action?

Closing the action gap means moving employees from “I should do something” to “I just did.” That shift requires three things:

• Continuous, behavior-focused reinforcement. Security awareness isn’t a one-time event. It’s built through small, repeated touchpoints delivered over time — not a single annual module.
• Real-world scenarios employees actually recognize. Abstract warnings about “AI threats” don’t stick. Concrete examples — a manipulated video, a fake smart-device app permission request — do.
• Simple, repeatable actions. Every piece of content should end with one clear action an employee can do right now, not a list of ten best practices to research later.

At Aware Force, this is the model we build around. Because our content is shaped by what’s current, we’re not guessing at what confuses or worries people — we know, and we build the next round of content to answer it directly.

The action gap is a solvable problem

Employee concern about AI, privacy, and connected devices isn’t the issue. The issue is that concern without action is meaningless. Treat this as a training problem, and you will keep seeing the same gap next year. Treat it as a behavior problem — one solved through recognizable scenarios and repeatable habits — and the gap will start closing.

The full report breaks down these numbers by category, including AI and privacy behavior, password habits, and mobile risk. Download the full Insights on Employee Cybersecurity Behavior report to see where your workforce likely stands — and what to do next.

FAQ

What is the “action gap” in cybersecurity awareness?
The action gap is the disconnect between employees’ stated concern about cybersecurity risks and their actual behavior. Aware Force’s data shows 85% of employees are concerned about AI-enabled smart home devices, yet only 19% use a password manager — concern that never converts into action.

Why doesn’t more training close the action gap?
Half of employees report they lack access to or don’t engage with existing training. Annual, check-the-box training doesn’t reinforce behavior over time, and it doesn’t give employees a specific action to take when a risk appears.

What data is this report based on?
The findings come from Aware Force’s twice-monthly reader polls, based on over 9,000 responses collected from employees across a range of industries.

How is Aware Force different from typical cybersecurity training?
Instead of static, once-a-year modules, our approach uses short, repeatable, scenario-based content shaped to address what employees are actually confused or worried about right now.

Who should read the full report?
Leaders responsible for reducing human-driven cyber risk will find the report useful for benchmarking employee behavior and building a case for behavior-based awareness programs.