How Cyber-Aware Are You?

You receive an email from your bank asking you to verify your account by clicking a link. What do you do?

Phishing emails often impersonate trusted organisations to steal credentials. Always verify through official channels.

• A Forward it to a colleague to check if they got the same email.
• B Check the sender address carefully and look for red flags before deciding.
• C Ignore the email, navigate to the bank website directly, and report the message.
• D Click the link and enter my details — it looks legitimate.

A colleague sends you an unexpected email with an attachment labelled "Urgent — open immediately". What is your first action?

Attackers often compromise accounts and use urgency to pressure recipients into opening malicious attachments.

• A Do not open it, verify via phone or in person, and report to IT if unconfirmed.
• B Contact the colleague through a different channel to verify they sent it.
• C Open the attachment — it's from someone I know.
• D Reply to the email asking what the attachment is about.

How do you manage passwords across your different online accounts?

Password reuse is one of the top causes of account compromise. A password manager significantly reduces risk.

• A I use different passwords for important accounts and write them in a notebook.
• B I have a few variations of one password that I rotate.
• C I use the same password for most of my accounts.
• D I use a password manager to generate and store unique passwords for every account.

Do you use multi-factor authentication (MFA) on your personal accounts?

MFA adds a critical second layer of security. Even if your password is stolen, MFA can prevent unauthorised access.

• A I've heard of it but haven't set it up.
• B I don't know what MFA is.
• C I use it on some accounts like email and banking.
• D I use MFA on all accounts that support it, preferring authenticator apps over SMS.

Someone calls you claiming to be from IT support and asks for your login credentials to fix a problem. What do you do?

Legitimate IT departments will never ask for your password over the phone. This is a classic social engineering tactic.

• A Give them my credentials — they sound professional and urgent.
• B Refuse to give credentials and tell them I'll call the IT helpdesk myself.
• C Ask them to explain the problem first, then decide.
• D Refuse, hang up, call IT through the official number to verify, and report it.

You need to use public Wi-Fi at a coffee shop to check your work email. What precautions do you take?

Public Wi-Fi networks are easy to intercept. Using a VPN encrypts your traffic and prevents eavesdropping.

• A I connect and use it normally — Wi-Fi is Wi-Fi.
• B I use a VPN, avoid sensitive tasks, and use my mobile hotspot when possible.
• C I avoid online banking but check email freely.
• D I use a VPN before accessing anything sensitive.

How do you share sensitive documents with colleagues?

Email attachments can be intercepted. Encrypted file sharing and access-controlled platforms are safer alternatives.

• A I use encrypted, access-controlled sharing and set expiry dates on links.
• B I email them as attachments — it's the easiest way.
• C I share via a company-approved platform with access controls.
• D I use a cloud drive link but don't restrict access.

A colleague asks you to email them a spreadsheet containing customer personal data. What do you do?

Emailing personal data without encryption may violate data protection regulations like GDPR.

• A Send it but put "Confidential" in the subject line.
• B Password-protect the file and send the password separately.
• C Send it immediately — they need it for their work.
• D Share via a secure, access-controlled platform and verify they need it.

Do you lock your computer when you leave your desk, even briefly?

An unlocked computer gives anyone passing by full access to your files, email, and systems.

• A No, I don't usually bother — I'll only be away for a moment.
• B Always — I use Win+L or Cmd+Ctrl+Q as a habit, and have auto-lock enabled.
• C Yes, I lock it manually most of the time.
• D Sometimes, if I'm leaving for a long time.

Someone you don't recognise follows you through a secure door. What do you do?

Tailgating is one of the simplest ways to bypass physical security. Politely challenging unknown individuals protects everyone.

• A Ask them to badge in separately and report the incident to security if they can't.
• B Politely ask if they have a badge or are visiting someone.
• C Hold the door open for them — it would be rude not to.
• D Let them through but feel uneasy about it.