WatchGuard survey finds employees trust digital messages

WatchGuard has released a global survey on employee trust in digital communications. The research found that 55% of respondents do not always verify the sender before acting on sensitive requests.

The company's inaugural 2026 Cyber Trust Index surveyed more than 500 full-time employees across eight countries, including Australia. It examined how workers assess messages, requests and other digital communications as AI tools make impersonation more convincing.

Across the sample, 46% of employees said they trust digital communications more than they did five years ago, while 31% said they trust them less. At the same time, 54% said they had encountered an AI-generated scam, deepfake, impersonation attempt or other fraudulent communication.

The findings suggest familiarity remains a strong influence on employee behaviour. Some 72% said they had clicked a link or opened an attachment because it appeared to come from someone they knew.

When asked what makes a digital request seem trustworthy, 38% cited a known sender, 36% pointed to a familiar workplace or personal detail, and 32% cited correct company branding. Only 27% said independent verification made them trust the request.

Australian contrast

Australia stood out for combining comparatively high trust in digital content with stronger checking habits. Some 69% of Australian respondents always verify sensitive requests, the highest rate among the eight countries surveyed, compared with 22% in Germany.

Australian respondents also reported relatively high confidence in digital communications. Some 59% said they trust digital content, second only to respondents in the US at 62%.

The same pattern appeared in responses to urgent executive messages. In Australia, 39% said they would be likely to trust an urgent text from their Chief Executive Officer requesting payment or sensitive information without verification, compared with 59% in the US. Globally, 42% said they would be likely to trust such a text, and 40% said they would trust a similar voice message.

Video requests were another area of concern. More than half of respondents, 53%, said they rely on a person's face, voice or display name to verify an unusual or sensitive video request, while 28% said they prioritise another channel or an organisational procedure.

Training gap

The survey also pointed to weaknesses in internal preparedness. Some 38% of respondents identified insufficient training or employee awareness as their organisation's biggest obstacle to cybersecurity preparedness.

Regional responses varied beyond Australia. Respondents in Italy identified a cybersecurity skills shortage and lack of qualified staff as the main obstacle to cyber trust, while respondents in Spain cited a gap in organisational security training as the leading issue.

Industry results also differed. Healthcare had the highest verification rate at 63%, while financial services respondents reported the highest trust in digital content. Government workers were described as the most sceptical of digital communications and Chief Executive Officer texts, yet less than half verified sensitive requests.

Corey Nachreiner, Chief Information Security Officer at WatchGuard, said the data showed a mismatch between employee behaviour and the risks created by AI-enabled impersonation.

“The most striking finding isn't that employees trust digital communications,” said Corey Nachreiner, Chief Information Security Officer at WatchGuard.

“It's that many continue to trust the same signals they've relied on for years, even as AI makes those signals easier to imitate. Familiar names, voices, faces and brands have always helped people make quick decisions, but they're no longer reliable indicators of authenticity. Verification is becoming one of the most important cybersecurity skills employees can have.”

The results point to a widening gap between trust and verification in workplaces, particularly as AI tools make it easier to mimic senior executives, colleagues and brands in text, voice and video. They also suggest employees often continue to use visual and contextual cues as a proxy for authenticity.

For businesses, that raises questions about how payment requests, credential resets and the sharing of confidential data are approved internally. The findings suggest established habits around recognising names, branding and familiar context remain deeply embedded even as the reliability of those signals declines.

WatchGuard recommends that organisations document confirmation procedures for payments, credential resets and confidential data sharing, create executive impersonation scenarios in staff training, and set rules around approved AI tools, data handling and human review.

The survey's central finding is that trust in digital communication is rising even as many employees do not consistently carry out independent checks before responding to sensitive requests.