You trust your team—they’re smart, capable, and they’ve sat through their fair share of phishing training. Surely, they wouldn’t fall for an obvious scam email... right?

That’s what most employees believe. In fact, 86% of workers are confident they can spot a phishing attempt, yet over half have already fallen for one.

Here’s the disconnect: confidence doesn’t equal capability. And in cyber security, overconfidence can be dangerous.

The Overconfidence Trap

Cyber criminals know how to exploit human behaviour, and overconfidence is one of their favourite tools. Today’s phishing emails aren’t full of typos or outlandish promises from foreign royalty. They look legitimate—sometimes even internal.

We’re talking about:

• Realistic emails from fake suppliers
• Convincing invoice attachments
• Messages that seem to come from colleagues or leadership

These scams rely on urgency, trust, and familiarity. And when employees assume they’re “too smart” to be fooled, they’re less likely to pause and verify.

This is a textbook case of the Dunning-Kruger effect—a cognitive bias where people overestimate their knowledge or ability. In cybersecurity, it leads to complacency, and complacency leads to breaches.

Why Confidence Isn’t Enough

Employees who are overly confident may:

• Skip over red flags
• Click without verifying sender details
• Fail to report suspicious messages

All of these open the door to data loss, system compromise, and costly reputational damage.

What Can You Do?

The fix isn’t to distrust your team—it’s to empower them. That starts with shifting the culture around cyber threats.

Here’s how:

Provide ongoing, up-to-date phishing training. Don’t assume once is enough—scams evolve constantly.

Foster a culture of openness. Make it easy (and safe) for employees to report suspicious messages without fear of blame.

Promote cautious behaviour over confidence. Make “better safe than sorry” the default approach.

Cybersecurity isn’t about being the smartest person in the room—it’s about being the most cautious. Your team doesn’t need to know everything; they just need to know how to spot something off and speak up.

The next time someone says, “I’d never fall for that”—that’s your cue to double down on training!