The key facts

  • 39% of EU employees have encountered phishing; 18% — attempted identity theft, 17% — malware, 16% — attempts to obtain passwords
  • Average annual cost of insider incidents: North America — $24.0 million, Europe — $18.6 million (Ponemon Institute)
  • According to an ISMA survey, more than half of CSOs report up to nine threats per year against top executives or their families; 44% of security chiefs expect economic instability as the main threat

Cyber threats: the scale according to a European Commission survey

As part of the EU Cybersecurity Month, a survey conducted for the European Commission showed that three out of four employees encounter suspicious emails, messages or links at work. 39% received phishing messages or landed on fake websites, 18% reported attempted identity theft, 17% — malware attacks, 16% — attempts to obtain passwords.

Threats broader than cybercrime

In the opinion of the Euronews columnist, a former police officer, cyber risks are just the tip of the iceberg. Companies, executives and employees are vulnerable on more fronts than ever: threats from organized groups and 'unfriendly states' include, for example, the risk of kidnapping employees on business trips. Threats from lone actors and small groups, which are harder to detect, are also growing.

Insider threats and their cost

A separate problem is insider threats from disgruntled current or former employees. According to last year's Ponemon Institute report, the average total cost of incidents grew by roughly 135% from 2018 to 2025. North American companies bear the greatest financial damage — $24.0 million per year in 2025; Europe ranks second with $18.6 million.

Physical threats to executives and their families

Violent threats against CEOs and top executives, including their families, are also growing. The most notorious example is the murder of UnitedHealthcare CEO Brian Thompson in the US in 2024; in Europe — last year's attempted kidnapping of the daughter of Pierre Noizat, head of a French cryptocurrency company. A survey by the International Security Management Association (ISMA) showed: more than half of the security directors surveyed reported that their top executives or their families receive up to nine threats per year — online, by phone, in writing or in person. Relatives' digital footprints on social media, public registries and AI tools make information gathering easier: in one executive vulnerability assessment study, publicly discoverable home addresses were found in 94% of cases.

Why risks are harder to predict

The author notes that escalation to violence used to follow a trackable path from predictable sources, whereas today risks are increasingly difficult to map. One theory behind the rise in threats is the merging of economic hardship and politics in people's minds, with business becoming the nearest visible symbol. A survey by Allied Universal of more than 2,300 security chiefs in 31 countries showed: 44% expect economic instability to be the main threat in the coming year. Political polarization adds tension: a 2024 Littler report showed that 86% of European employers struggle with managing polarized political views at work (a year earlier — 75%); the upcoming general election in Spain amid polarization and civil unrest is cited as an example.

How businesses are responding

Recommended practice is detailed mapping of potential 'trigger points': corporate announcements (for example, about profits or a refusal to fund drug research) or a CEO's public political statements can become a catalyst for a threat. AI, in the author's view, can play a major role: object recognition on CCTV, facial recognition, social media monitoring, weapon detection and predictive analysis. ISMA is a global organization founded in 1983, uniting about 375 top security executives, including from 25 FTSE 100, DAX and CAC 40 companies, most of the Fortune 100 and 25% of the Fortune 500, including MetLife, S&P Global, Sky, Four Seasons, Unilever and Novo Nordisk.