Describe your workforce, policies, and research goals. Makeform creates an editable cyber security survey about phishing, account habits, devices, data handling, and incident reporting without requesting secrets.
Route survey responses to Google Sheets, Slack, and Zapier.
Sample prompts for the survey builder
Choose a prompt, adapt it to your policies, or send it to the Makeform builder. The structure is an example.
Audience
Employees across departments and locations
Format
Anonymous survey with rating scales and scenarios
Prompt size
340 chars
Example survey structure
Anonymous survey with rating scales and scenarios
How confident are you recognizing a suspicious message?
Which action would you take after an unexpected login prompt?
How often do you use approved security tools?
Do you know where to report a suspected incident?
Which security topic would help you most?
Suggested analysis tags
Awareness gaps
Practice gaps
Training requests
Ask about behavior and confidence, never passwords, recovery codes, access tokens, or private keys.
Step 1
Define
audience, policies, and decisions
Step 2
Build
neutral questions and safe scenarios
Step 3
Distribute
anonymous or identified survey link
Step 4
Act
segment gaps and plan follow-up training
Why survey employees
A cyber security survey shows employee confidence, reported behavior, and obstacles. It supports planning but does not prove controls work or answers reflect actual behavior.
Pair confidence scales with scenarios to reveal where certainty and safer choices diverge.
Branch by department, work setting, or device so each group sees relevant situations.
Ask about practices and barriers while excluding credentials, tokens, keys, and device details.
Survey programs
A baseline, topic check, and post-training pulse answer different questions. Start with the purpose instead of combining them.
Measure habits, scenarios, reporting knowledge, and training requests.
Use realistic email, chat, payment, and MFA scenarios.
Branch around devices, privacy, storage, connectivity, and reporting.
Check comprehension and ask what needs clearer examples.
Survey workflow
Provide context, then review the wording, distribution settings, and response plan before sending.
Name the groups, purpose, anonymity choice, completion time, and intended use.
Remove secrets, double questions, blame, absolutes, and incomplete answer choices.
Explain purpose, anonymity, result access, closing date, and the real incident channel.
Compare topics, prioritize education, and repeat stable items later.
Choose the method
Surveys cover perceptions, quizzes cover knowledge, and authorized simulations observe controlled responses. None alone proves readiness.
Field guide
These six sections create a focused baseline. Adapt them to your policies and reporting channels.
Phishing awareness
Use short scenarios involving urgency, payment changes, MFA prompts, or unfamiliar sign-in pages. Base the safest action on your process.
Account practices
Measure awareness of approved password tools and multi-factor authentication without requesting account names, codes, or secrets.
Devices & remote work
Use conditional logic for managed laptops, personal phones, shared spaces, and public networks. Include not applicable.
Data handling
Ask how employees would share, store, print, or dispose of fictional information without requesting real data.
Incident reporting
Ask how employees would report suspicious messages, lost devices, or accidental disclosure. Display the real incident channel separately.
Training priorities
Ask which topics need help. Use broad groups and avoid combinations that could undermine anonymity.
Related tools
Pair the survey with quizzes, training feedback, risk intake, and incident forms.
Create a focused knowledge check using security scenarios and clear answer choices.
Open toolCollect feedback on the relevance, clarity, and pacing of awareness training.
Open toolGather structured risk observations from business teams for internal review.
Open toolDocument closure details and follow-up actions after an incident workflow.
Open toolGive employees a dedicated route for reporting suspected security events.
Open toolBuild a broader employee survey when security is only one part of the topic.
Open toolFAQ
Practical answers for IT, security awareness, and compliance teams planning an employee survey.
It measures employee awareness, self-reported practices, confidence, obstacles, and training needs across topics such as phishing, devices, data handling, and reporting. Results support planning but do not verify controls or behavior.
Mix neutral behavior questions, confidence scales, scenarios, reporting questions, and training feedback. Offer not applicable and I am not sure. Never request passwords, codes, tokens, private keys, or confidential content.
Anonymous surveys may encourage candor; identified surveys support assigned follow-up. State the setting, collect only necessary attributes, and ensure small role or department combinations cannot undermine promised anonymity.
Keep it as short as the decision allows. Use branching, remove repetition, test completion time, and retain questions that lead to a training or process action.
Use neutral wording and one idea per question. Avoid blame, leading language, and treating confidence as knowledge. Pilot realistic answer choices, including uncertainty and not applicable.
Yes. Use short, fictional situations and align the safest response with your process. Exclude real malicious links, personal data, credentials, and sensitive incident details.
Yes. Makeform provides unlimited free form creation, editing, publishing, and responses. The paid tier removes the Makeform badge.
Separate knowledge, confidence, and process barriers; prioritize targeted training; and repeat stable questions later. Route urgent incidents through the dedicated response channel, not the survey queue.
Turn awareness questions into a useful baseline.
