Only 31% of Spanish employees surveyed by WatchGuard Technologies always confirm sensitive requests—such as a bank account change, a wire transfer, or a request for confidential data—through an independent channel. The figure comes from the company’s Cyber Trust Index, built from more than 500 employees in eight countries, and places Spain near the bottom of the table, ahead of only Germany (22%) and Portugal (28%).
Key takeaways from WatchGuard’s Cyber Trust Index in 30 seconds
- WatchGuard surveyed more than 500 full-time employees in eight countries, 62 of them in Spain.
- In Spain, 69% don’t always verify sensitive requests, and 76% have clicked a link or attachment because it looked like it came from someone they knew.
- 48% would trust an urgent text message from the CEO asking for a payment or data without checking it.
- Only 23% would verify a suspicious video call through another channel.
The study starts from a simple premise: trust in digital tools isn’t the problem—it’s the habit of taking a communication at face value because it looks right. 42% of those surveyed in Spain say they trust the communications and content they receive through digital channels more than they did five years ago, versus 39% who trust them less and 19% whose opinion hasn’t changed. Globally, the balance tilts a bit further toward trust: 46% versus 31%.
What matters is which signals employees use to decide something is legitimate. In Spain, 42% rely on correct corporate branding, 32% on the message mentioning a familiar work or personal detail, and 26% on recognizing the sender. Only 16% count independent verification among their reasons for trusting a request. Those are exactly the signals an attacker can copy with a logo, a compromised email account, or information pulled from social media.
The urgent CEO message still works
Executive impersonation—the classic CEO fraud—shows up as one of the weakest points. 48% of Spanish employees admit they would probably trust an urgent text message from the CEO or company owner asking for a payment or confidential data, without verifying it. If the message is a voice message, the figure drops to 44%. Across the full sample the numbers are 42% and 40%, with the United States topping the list at 59% for the text message.
The report itself qualifies these answers: they measure implicit trust, not willingness to actually complete a transaction the employee knows is fraudulent. Even so, WatchGuard concludes that neither the identity of the person making the request nor the urgency of the request should ever justify skipping verification procedures, and that employees need both a confirmation protocol and explicit backing from leadership to apply it—even when the order appears to come from above.
Video calls, increasingly used in deepfake-based fraud, don’t fare well either. Faced with an unusual or confidential request by video, 63% of those surveyed in Spain would judge the identity of the other party by their face, voice, or the name shown on screen—ten points above the global average (53%). Only 23% would prioritize checking it through another channel or an internal procedure, versus 28% globally. Across the full study, 54% say they’ve encountered an AI-generated scam, a deepfake, an impersonation attempt, or a fraudulent communication, though WatchGuard notes the question grouped all of these situations together and doesn’t reveal how many actually involved AI.
Corey Nachreiner, WatchGuard’s chief information security officer (CISO), sums up the company’s approach in one line: «Verification is becoming one of the most important cybersecurity skills for employees».
Spain near the bottom on verification
The country comparison shows that trusting less doesn’t mean verifying more. Australia posts the highest share of employees who always verify (69%) despite fairly high trust in digital content (59%). At the other end, Germany sits at 22%. Spain, at 31%, shares the low band with Portugal, and is also among the countries where fewest employees consider their organization well-prepared against a cyberattack: 40%, versus 73% in the United States or 67% in Australia. Globally, only 21% believe their company is fully prepared to prevent or withstand a major attack.
Asked about the main obstacle to improving, Spanish respondents point mainly to insufficient training (32%) and, further behind, lack of awareness (15%). Across the full sample, 38% cite one of those two causes. The report places Spain, Portugal, and France among the countries particularly concerned about training, while in Italy the bigger weight falls on a shortage of cybersecurity staff and skills.
By sector, healthcare verifies the most (63% always do so), financial services shows the highest trust in digital content (72%) but fewer than half always verify (43%), and public administration is the most skeptical sector, though it too falls short of half on constant verification (47%). Insurance posts the lowest rate, at 22%.
Generative AI adds another layer. Fewer than half of respondents (47%) trust these tools, but only 32% always verify what they generate before acting on it, and just 56% believe their employer uses AI responsibly and safely.
What the report doesn’t make clear
The figures are worth reading with some caution. The Spanish sample is 62 people, and other countries sit around 50 to 60, so the national percentages describe the attitudes of small groups. The report itself acknowledges this, noting that these samples don’t support national cybersecurity performance rankings and that the sector-level data comes from even smaller subgroups. Neither the press release nor the report specifies the fieldwork dates, the firm that ran the survey, or the margin of error. The study was also commissioned by a company that sells security solutions, mostly through managed service providers (MSPs).
WatchGuard’s recommendations, beyond its own products, are the usual awareness-building measures: requiring confirmation through a previously established contact for payment changes, data transfers, and unusual access requests—applying that same rule to executives; running realistic drills with fake messages, voices, and video calls; publishing clear rules on which AI tools are approved and what data can’t be entered into them; combining phishing-resistant multi-factor authentication with email filtering, endpoint protection, least privilege, and tested backups; and providing simple channels to report incidents without fear of retaliation. The company closes its release by highlighting its zero-trust approach and its 24/7 managed detection and response (MDR) service—a commercial offer that isn’t part of the survey results. WatchGuard says it works with more than 25,000 MSPs and protects more than 1.5 million customers.
For anyone managing security at companies running their own infrastructure or operating in the cloud, the practical takeaway is that technology only covers part of the risk: no firewall stops a wire transfer approved because of a convincing phone call. WatchGuard’s other recent work follows the same thread—its first-half 2026 threat report describes the shift from mass campaigns to more targeted, AI-assisted attacks.
The complete global report, in Spanish, WatchGuard Cyber Trust Index (PDF), includes all the country- and sector-level tables.
Frequently asked questions
What is WatchGuard’s Cyber Trust Index?
It’s a survey by WatchGuard Technologies of more than 500 full-time employees in the United States, the United Kingdom, France, Germany, Italy, Portugal, Spain, and Australia on how much they trust digital communications and how they verify them.
How many employees in Spain always verify sensitive requests?
31% of those surveyed in Spain say they always verify through an independent channel. Only Germany (22%) and Portugal (28%) post lower rates.
Is the Spanish data representative?
The Spanish sample is 62 people. The report itself warns that the country-level samples are small and don’t support national rankings, and it doesn’t publish a margin of error.
What does WatchGuard recommend to reduce the risk?
Making it mandatory to verify payments, confidential data, and unusual access requests through an already-known contact, training with realistic drills, setting rules for AI use, and combining layered technical protections with simple channels for reporting incidents.
Sources:
- WatchGuard Technologies, press release on the Digital Trust Index in Spain
- WatchGuard Technologies, Cyber Trust Index (global report, PDF)
This article is also available in Spanish: «Solo el 31 % de los empleados en España verifica siempre las peticiones sensibles», on Revista Cloud.
