Phishing survey about the last suspicious message at work
Fourteen anonymous questions for employees: how they spotted the message, what they did first, and whether reporting felt safe.
- 14questions
- about 4 minto answer
- Anonymousno names or teams
- 1 messagethe last one they remember
The 14 phishing survey questions
A phishing survey is a short anonymous questionnaire that asks employees about the last suspicious message they received at work: how it arrived, what gave it away, what they did first, and whether reporting it was quick and safe. All fourteen questions are ready to edit in the free survey builder.
The message
One remembered message, so the answers describe what people did.
- Think of the last message at work you suspected was phishing, real or a company test. When did it arrive?
- How did it reach you?chat, text and phone often sit outside the report button.
Spotting it
What tipped them off, and how sure they were.
- What made you suspicious? Tick all that apply.kinds of warning sign, counted across everyone.
- I was sure it was phishing before I did anything with it.unsure and reported at question 5 is the result you want.
What they did
The first move, then whether reporting was quick and answered.
- What did you do first?the key answer: the share whose first move was a report.
- If you reported it: reporting took me less than a minute.low scores point at a report button that is hard to find.
- If you reported it: somebody told me what happened next.a reply after every report keeps people reporting.
Reporting safely
Whether owning up is safe, and the first steps after a slip.
- I could report a message I had already clicked without worrying about getting into trouble.read it beside question 5.
- I know what to do in the first few minutes if I have typed a password into a page I should not have.a low score is fixed with one clear instruction.
Training and tests
Whether training and tests match the messages people get.
- The phishing training I have had looks like the messages I actually receive.low scores mean the examples need to come from your own channels.
- If your company runs phishing tests: they feel like practice rather than a trap.
Next time, and overall
The outcome, one change in their own words, and one rating.
- If a convincing message arrived tomorrow, I would report it even if I was not sure.the headline: the share who would report even when unsure.
- What one change would make you more likely to report a suspicious message?one change each, so the answers can be counted and ranked.
- Overall, how prepared do you feel to handle a phishing message at work?
Sending the phishing survey and reading the answers
Send it to everyone who gets work messages, within a week of a phishing test or a real wave of attacks. Say above question 1 that no names are collected and that answers are never matched to test results.
Read question 12 first: the share who would report a convincing message even when unsure. Set it beside question 5, the share whose first move was a report. Low agreement at question 8 means people expect blame. National guidance is plain that staff who fear reprisals report late.[1]
A low question 10 calls for a post training survey on the course itself. Before buying the next course, run a training needs assessment survey. Slow help after a click is a subject for the IT survey questions for employees. A message that became a breach gets a crisis management survey.
Phishing survey FAQ
What questions should a phishing survey ask?
How the last suspicious message arrived, what gave it away and what the person did first. Weight it toward reporting: in a 15-month study of more than 14,000 employees, staff reports gave fast detection of new phishing campaigns.[2]
How is a phishing survey different from a phishing test?
A test sends a simulated message and records who clicks. A survey asks people what they noticed and what they did, which explains the test results.
Should a phishing survey be anonymous?
Yes. Question 5 asks whether somebody opened a link, and people answer that straight when no name is attached. A full year of security habits is a different job, done by the cyber security questionnaire for employees.
What is survey phishing?
A scam that poses as a survey, often with a prize, to collect passwords or card details. A real survey never needs your password. The fourteen questions here ask for no names, logins or personal details.
Michael Hodge, survey methodology · Updated 2 October 2026 · How templates are reviewed
Sources (2)
- UK National Cyber Security Centre. "Phishing attacks: defending your organisation." ncsc.gov.uk
- Lain, D., Kostiainen, K. and Capkun, S. "Phishing in Organizations: Findings from a Large-Scale and Long-Term Study." IEEE Symposium on Security and Privacy, 2022. arxiv.org
Ask while the last message is still fresh
Fourteen questions, about four minutes, anonymous.
Use this template