Of Dutch employees with an office job, 83 per cent carry out at least one digital task on autopilot every day. That is the finding of research by PanelWizard, commissioned by HP, among 1,051 employees. More than 64 per cent are quicker to trust requests from a familiar sender, and almost 40 per cent find it increasingly difficult to tell the real from the fake.
According to HP, attackers are increasingly exploiting actions that employees perform without thinking, such as opening a document, logging in or scanning a QR code. The company says such an attack works because the next step feels normal, and therefore stands out less than a message that is clearly unusual. Among their routine actions, respondents cite replying to a message from a familiar colleague (66 per cent), opening an email (61 per cent) and logging in to a trusted website (59 per cent).
Fake installation page
Respondents were shown a fake Microsoft Word installation page. Of these, 43.7 per cent thought the page was genuine and 17.3 per cent were unsure. This means more than six in ten failed to recognise the page as fake.Behavioural scientist Florien Cramwinckel sees this as a problem for traditional security awareness. People are used to looking for danger in what is out of the ordinary, she says, whereas in their everyday tasks they work on autopilot. When criminals convincingly imitate that routine, according to Cramwinckel, the signal that employees have been taught to watch out for disappears.
Attacks via trusted actions
HP links the research findings to its HP Threat Insights, which are based on threat intelligence from HP Sure Click and other HP Wolf Security technology. In one of the campaigns examined, a PDF used a QR code to lead victims to a seemingly normal authentication step on their mobile phone. In another attack, malware was disguised as an AI tool.The company reports that reading attachments, logging in via a mobile phone and downloading software are increasingly being used as attack vectors, rather than a clearly suspicious link.
Mnemonic for five moments
Cramwinckel does not advocate teaching employees to distrust every email or website. She calls that unworkable, because routines are precisely what enable people to work efficiently. In her view, the key is to recognise the moments when it is wise to briefly interrupt the autopilot.To that end, Cramwinckel developed the mnemonic DIS ME NIET. It focuses on five actions: downloading, logging in, scanning, switching to mobile or to another device, and enable, i.e. turning on additional permissions or features. For these actions, she recommends a quick check: was I expecting this step, is the environment I am landing in correct, and does the request make sense?
Limiting the consequences of mistakes
Of the respondents, 86 per cent say they would report a suspected phishing incident on their own initiative. Other actions are barely mentioned: only 2 per cent cite disconnecting from the network or securing an account or session themselves.HP says cybersecurity should therefore also focus on limiting the consequences when an employee does make a mistake. According to Cramwinckel, you cannot place the responsibility entirely on the employee when an attack has been designed around human habits. Organisations, she says, also need to look at the system around them, so that the consequences of a mistake are kept to a minimum.Cramwinckel and Rajjendra Sitompoel of HP have written a white paper on the interplay between human behaviour and technological security. The white paper and the full research findings are available on request.
About the research
PanelWizard conducted the research online from 8 to 15 October 2026 among 1,051 Dutch employees aged 18 to 65 with an office job. The sample is representative in terms of gender, age, labour participation and level of education. The maximum margin of error is 3.0 percentage points at a 95 per cent confidence level.
This article was originally published in Dutch on MSP Business. Read the original →
