Summary:  An Aware Force research study of over 9,000 employees worldwide shows: cybersecurity awareness isn’t losing to apathy — it’s losing to competing priorities like screen time and lifestyle or career upgrades. Only 10% of employees prioritize a password manager, while 44% want to cut screen time. The fix: align security with goals employees already have.

“Security isn’t competing with apathy. It’s competing with priorities.
Employees say they’re worried. Then they do nothing about it. And that gap — not ignorance, not apathy — is where your organization’s real exposure lives.”

That’s one of the sharpest findings in Aware Force’s new report, Insights on Employee Cybersecurity Behavior, based on 9000+ employee responses.

[QUOTE] Employees aren’t tuning out cybersecurity because they don’t care. They’re tuning it out because other priorities are winning the competition for their attention.

Employees have strong passwords but weak security habits?

Most employees believe they create strong passwords. The data tells a more complicated story.

Insights on Employee Cybersecurity Behavior Edition 1, 2026 – Aware Force

• Thirty-seven percent say maintaining a unique password for every account is their hardest security habit. 
• Fifty-five percent manually track passwords instead of using a secure tool. 
• Only 2 in every 10 use a password manager. 
• Fourteen percent reuse the same password across multiple accounts, and 13% only change a password when they’re forced to.

The problem isn’t a knowledge gap. It’s a usability gap. Employees default to the easiest option in front of them, even when they know it’s the riskier one. Manually tracking passwords feels more familiar than adopting a new tool, so they do it —regardless of the risk it creates.

What are employees prioritizing instead of cybersecurity?

Here’s where the “competing priorities” framing becomes concrete. When asked what they want to change about their digital lives:

• 44% of employees say reducing screen time is a top goal. 
• 18% want to cancel unused subscriptions. 
• 17% want to learn how to use AI to be more productive — as a career or lifestyle upgrade, not a security move.
• Only 10% prioritize installing a password manager

Employees are actively working to improve their digital lives. They’re just not connecting that effort to security. A password manager doesn’t feel like decluttering. Reviewing app permissions doesn’t feel like a productivity win. Until security is framed around the employees’ existing goals, it will keep losing that competition.

How can leadership align security with what employees already care about?

The fix isn’t more warnings. It’s better positioning. Three approaches from the report stand out:

• Make the secure choice the easy choice. Employees adopt secure tools when they’re clearly less effort than their current habit — not just more secure. Step-by-step comparisons work better than abstract recommendations.
• Place security next to existing goals. When “lock down your accounts” sits next to “declutter your phone,” employees are far more likely to act on both.
• Address behavior beyond the workplace. Mobile apps, family devices, and personal accounts all shape workplace risk. Content that acknowledges this gets more attention than content that pretends employees only use technology at their desk.

At Aware Force, we build this alignment directly into our content because our model depends on it — we run ongoing polls with employees every two weeks, so we know in real time what’s competing for their attention, and we shape content to meet them there instead of fighting for space against it.

Meet employees where their attention already is

Security teams that keep competing head-on with employees’ priorities keep losing. Victorious teams position secure behavior as part of their employees’ own goals.

The full report includes additional detail on password behavior, mobile risk exposure, and the specific language that moves employees from awareness to action. Download the full Insights on Employee Cybersecurity Behavior report for the complete breakdown.

Can You Prove Your Cybersecurity Awareness Program is Making a Difference?

That’s an uncomfortable question. Can you? Most security leaders can’t. Not because they haven’t invested — but because most programs measure the wrong things. 

With that in mind, we’ve developed a free, fast self-assessment tool that shows what your metrics are missing: real behavioral gaps, blind spots in your content, and best practices in human learning you are likely ignoring. 

Find what your metrics are missing: real behavioral gaps, blind spots in your awareness program, and what your content lacks. It takes five minutes. The next incident won’t give you that long.