text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: th 2022 marked the ECSM’s 10 year anniversary and special activities were put to place for its celebration.

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: March 2023

text: ENISA Promotional Material

text: General https://cybersecuritymonth.eu/ Phishing Campaign https://cybersecuritymonth.eu/phishing Ransomware Campaign https://cybersecuritymonth.eu/ransomware

text: March 2023

identifier: European Cybersecurity Month 2022 Campaign Report

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: European Cybersecurity Month 2022 Campaign Report

serie: rapporter

text: ECSM 2022 CAMPAIGN REPORT European Cybersecurity Month (ECSM) 2022 MARCH 2023

type: rubrik

text: ECSM 2022 CAMPAIGN REPORT

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

type: stycke

text: CONTACT

text: For contacting the authors, please use ecsm@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu

text: AUTHORS

text: Marianna Kalenti & Peter Biro, ENISA

text: ACKNOWLEDGEMENTS

text: S2 Grupo, Kill Draper

text: LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2023

text: This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.

text: Cover image © 2023, ENISA

text: For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN 978-92-9204-629-3, DOI 10.2824/36758

text: ECSM 2022 CAMPAIGN REPORT

text: EXECUTIVE SUMMARY

text: The fact that users are the first line of defence in the cybersecurity chain, has rendered the need for cyber awareness-raising imperative and, as a response to that the European Cybersecurity Month 2022 campaign focused on two of the most prominent threats:

text: 1. Phishing: so that users may detect and react to the most common attack against individuals.

text: 2. Ransomware: so that users become aware of the threat, learn how to identify it and react to it, and realise its severity by getting to know its consequences.

text: The target audience of the campaign, employees between 45-65 years old, was decided as an attempt to address the gap that exists between younger and older generations, as far as digitalisation is concerned, but also because ransomware is a predominant threat with great potential for damage to corporations.

text: What is more, the campaign was coupled with the commemoration of the ECSM’s 10th anniversary in 2022, which was celebrated – among others – with the production of a “crowdsourcing” video that brought together the testimonies of people from all MS & organisations that have made the ECSM possible over the years.

text: The specifics of the campaign included an additional motto “Choose To Be Safe Online”, which was used, along with the existing ones, in order to convey the above. Several videos were produced for both themes, as it has been found that they have significant impact on the public and encourage the retention of ideas.

text: These were included in the landing pages created within the ECSM website for the two themes, along with a series of tips and informational data, presented in visual format, and a quiz that tested the knowledge that users acquired during the campaign.

text: For the ECSM 2022, an evaluation study with the inclusion of behavioural metrics was conducted in order to measure behaviour change. Surveys are seen as the most feasible ways to measure behavioural change (ENISA, 2021), supporting the notion that refocus of cybersecurity behaviour change evaluation should be directed towards behavioural metrics in surveys, which is a better measurement than compliance rates which merely indicate completion, not a long term, conscious effect on behaviour (Jacobs et al., 2022). Data collected after the campaign was compared to data from before the campaign, in order to assess the impact of the awareness raising attempts on cybersecurity behaviour. Successfully, data has shown a significant increase in self-reported cybersecurity behaviour post-campaign and among people who saw information related to the campaigns about the “Phishing” and “Ransomware” themes.

text: The campaign also had another profound impact, which extends towards perceptions of cybersecurity risks, attitudes towards cybersecurity, social norms around it and beliefs in control over users’ appropriate responses to incidents which are all relevant aspects when aiming for cybersecurity behaviour change.

text: Some key findings of the campaign’s evaluation and behavioural research were:

text: • MS participated broadly in the ECSM 2022 and provided positive feedback for the campaign. • Dissemination of the campaign through social media was effective and a sustained growth of ENISA’s social media reach was observed. • Users interacted much more with the content compared to the interaction that resulted from the previous ECSM campaign. Furthermore, the ECSM 2022 generated a lot of interest outside Europe. • The campaign had a positive impact on cybersecurity behaviour compliance, as people who saw the campaign report to perform cybersecurity behaviour more than those who did not. • Data shows that all the cybersecurity behaviour types (related to email, password management, software updates, and network usage) have significantly increased in the target group after the campaign. • Most participants claimed the campaign was easy to understand, although some said they were overwhelmed at first.

text: ECSM 2022 CAMPAIGN REPORT

text: • The majority of people used the words “helpful”, “meaningful” and “informative” to describe the campaign and appreciated the applicableness of the offered guidance in avoiding the threats. • Respondents did not feel that the campaign needed much improvement, they believed the content was fairly comprehensive and informative already, although participants suggested that it would be beneficial to include even more examples from the real world.

text: ECSM 2022 CAMPAIGN REPORT

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 6

text: 1.1 THE ECSM STORY – CELEBRATING 10 YEARS OF CAMPAIGNS 6

text: 1.1.1 ECSM evolution through the years 6

text: 1.2 TARGET AUDIENCE OF THE 2022 CAMPAIGN 7

text: 2. CAMPAIGN TARGET & CONTENT 8

text: 2.1 ECSM 2022 VISION & OBJECTIVES 8

text: 2.2 ECSM AWARDS: A 2022 NOVELTY 8

text: 2.3 ECSM 10 ANNIVERSARY 9

text: 3. CAMPAIGN DESIGN 10

text: 3.1 ECSM 2022 THEMES 10

text: 3.1.1 Phishing 10 3.1.2 Ransomware 10

text: 3.2 ECSM 2022 TARGET AUDIENCE PERSONAS 11

text: 3.3 ECSM 2022 COMMUNICATION CHANNELS 11

text: 4. CAMPAIGN EXECUTION 12

text: 4.1 CONTENT CALENDAR 12

text: 4.2 LAUNCH OF THE ECSM 2022 12

text: 4.3 CAMPAIGN MATERIALS AND SOCIAL MEDIA CONTENT 12

text: 5. CAMPAIGN EVALUATION 14

text: 5.1 EVALUATION METHODOLOGY 14

text: 5.2 MS QUESTIONNAIRE 14

text: 5.3 ASSESMENT OF WEB RESULTS 15

text: 5.3.1 ECSM website 15 5.3.2 Cyber First Aid Map 15 5.3.3 Media monitoring 16 5.3.4 Social media 17

text: 5.4 BEHAVIOURAL CHANGE ANALYSIS 19

text: ECSM 2022 CAMPAIGN REPORT 6. CONCLUSIONS & RECOMMENDATIONS 20 ANNEX21

text: 2. VISITS OVER TIME: 21

text: 3. GEOGRAPHIC DISTRIBUTION 22

text: ECSM 2022 CAMPAIGN REPORT

text: 1. INTRODUCTION

text: 1.1 THE ECSM STORY – CELEBRATING 10 YEARS OF CAMPAIGNS

text: The European Union Agency for Cybersecurity (ENISA) and the European Commission

text: The European

text: jointly coordinate the ECSM campaign every year, with the aim to promote cybersecurity

text: Union Agency for

text: among European citizens and organisations through awareness-raising activities and materials created specifically for this purpose. Cybersecurity

text: (ENISA) and the

text: Supporting these campaigns are numerous EU Member States and hundreds of different European partners (including governmental entities, universities, think tanks, NGOs, professional

text: Commission

text: associations and private sector companies) from Europe and around the world.

text: jointly coordinate the ECSM

text: The representatives of the Member States and the different partners function as Ambassadors of this campaign. Their mission is to support and promote the campaign internally in their campaign every countries. They complement their own national cybersecurity-related campaigns with all the year, with the materials, activities and events created by ENISA, thus making it easier for ECSM content to

text: aim to promote

text: reach all EU countries in a way that is closer and more specific to the citizens of each one.

text: cybersecurity among European 1.1.1 ECSM evolution through the years citizens and

text: In 2011, the EU Agency for Cybersecurity was asked to study and assess the idea of creating a pan-European cybersecurity campaign for the Cybersecurity Month, October. organisations.

text: In 2012, the ECSM pilot project was launched across Europe. It involved the Czech Republic, Luxembourg, Norway, Portugal, Romania, Slovenia, Spain, and the United Kingdom, where several events and activities took place. It was supported and endorsed by the EU Agency for Cybersecurity and the European Commission.

text: In 2013, the ECSM aimed to increase the number of Member States involved, in order to focus on specific issues and start shaping the activities of this campaign across the European Union, which might have a global impact as well.

text: In 2014, a total of 184 activities took place in 30 different countries, targeting different audiences such as employees, digital users, students, and IT experts, and focusing on different topics, including updates, privacy and encryption.

text: In 2015, the number of activities reached more than 200 and two more countries joined the campaign. Activities were developed around the themes of cybersecurity culture, cloud solutions and the Digital Single Market.

text: In 2016, ECSM activities doubled the ones of the previous year, all related to the themes of Cyber Security in Banking, Cyber Training, Cyber Safety and Mobile Malware.

text: In 2017, the number of activities continued to grow from EU to EFTA countries, as 5 more countries joined, with the ECSM being represented in 37 different nations. The themes selected for that year were Cybersecurity in the Workplace, Governance, Privacy and Data Protection, Cybersecurity in the Home, and Skills in Cybersecurity.

text: Two countries dropped out in 2018, when the themes were Cyber Hygiene, Digital Skills and Education, Recognize Cyberscams, and Emerging Technologies and Privacy. Another country joined again in 2019, when Cyber Hygiene and Emerging Technologies were once more the themes.

text: COVID-19 burst into our lives in 2020, forcing a change in the approach of the ECSM during that year. Thus, a very powerful campaign was created under the umbrella concept "Think Before You Click", which centred around Cyber scams and Digital Skills and achieved a much higher outreach than in previous years.

text: ECSM 2022 CAMPAIGN REPORT

text: It is notable that, in 2021, 73% of the Member States surveyed stated that the campaign had helped them reduce the number of cyber incidents. The campaign that year focused on the “Be Cyber Secure from Home” and “Cyber First Aid” themes (the first time that a theme focused on the aftermath of becoming a victim of a cyberattack).

text: For the 2022 ECSM, the whole issue of cyber security at home, which was largely driven by the pandemic, was set aside to focus on the attacks themselves, with this year's themes being phishing (as the main entry vector exploited by cyber criminals when targeting people, rather than system vulnerabilities) and ransomware (as the most prolific and potentially damaging cyber-attack).

text: Figure 1. 10 Anniversary Logo

text: 1.2 TARGET AUDIENCE OF THE 2022 CAMPAIGN

text: We live in a hyper-connected society, where digital transformation has been accelerated by The target the pandemic caused by Covid-19, and technological progress is rapid and unstoppable. These

text: audience of the

text: facts have given cybercriminals a much larger attack surface, therefore it is imperative that

text: Phishing

text: the European society is prepared to deal with such attacks.

text: campaign was

text: The main target audience of the Phishing campaign was people over 45 and up to 65 people over 45

text: years of age, who are still employed. These people's everyday lives are largely digital, as and up to 65 they generally use technology for their professional tasks, but also in their personal sphere, with

text: years of age, who

text: mobile phones, tablets, smart devices, etc. This is coupled with an expected low or limited

text: are still

text: level of knowledge of the cybersecurity domain and, unfortunately, together these

text: employed.

text: characteristics render them an ideal target for cyberattacks, as well as the most easily exploitable entry vector for larger-scale attacks.

text: The target

text: In addition, in order to assure that the campaign would achieve to reach this type of audience, it audience for the was designed with a view to creating in them the feeling of "this could be me" and empowering

text: Ransomware

text: their active involvement in cybersecurity, so that they would become human firewalls for their

text: campaign was 45+

text: organisations and homes.

text: year old

text: In the Ransomware behavioural-change campaign, the target audience was 45+ year-old employees or employees of European companies and organisations. Those are the most exploited entry European points for cyberattacks, as they are unaware of the threats and seem used to delegating

text: companies and

text: responsibility to the IT Department or higher. This is why the campaign was created in a simple

text: organisations.

text: and understandable language, in order to alert them to a plain message: Anyone in your

text: company could be hit by ransomware.

text: ECSM 2022 CAMPAIGN REPORT

text: 2. CAMPAIGN TARGET & CONTENT

text: 2.1 ECSM 2022 VISION & OBJECTIVES

text: The mission of all entities that participated in ECSM 2022, was to establish a Cybersecure European space by raising awareness and providing EU citizens with tools and practical advice that would help them adopt more cybersecure routines and become “Human Firewalls”, consequently boosting the resilience of their professional place as well.

text: The key objectives of the 2022 ECSM campaign were to:

text: • Raise cybersecurity awareness in the European Society and create a more secure European Cyberspace, among EU citizens and organisations. • Create and disseminate awareness raising materials that provided the target audience with up-to-date online security information. • Coordinate and conduct awareness raising activities and events. • Encourage continuous behavioural change towards cybersecurity. • Help reduce the occurrence of cybersecurity attacks, establishing users as elements of defence rather than vulnerabilities. • Encourage the delivery of key awareness messages, via optimal channels, audio-visual designs and formats. • Create engaging content on the chosen topics, suitable for the chosen target audience. • Make use of efficient monitoring and evaluation mechanisms to assess campaign impact. • Engage relevant stakeholders and increase the participation of EU Member States, European and International partners. • Launch a pre and post-campaign research study in order to assess behavioural change in EU citizens’ cybersecurity posture, as a result of the ECSM campaign.

text: 2.2 ECSM AWARDS: A 2022 NOVELTY

text: In 2022, ENISA launched a joint action with the national ECSM Coordinators Group: the ECSM awards. The aim was, on the one hand, to increase visibility of the excellent and creative material the MS produced in the past years under the ECSM umbrella, and, on the other, to increase engagement and potential synergies.

text: In the 2022 ECSM

text: MS representatives involved in the process are to vote every year for the most innovative and

text: Awards Ireland

text: impressive materials produced for past ECSM campaigns. Thus, MS were asked to vote from

text: won best

text: a list of campaign material submitted to the competition.

text: infographic; st Greece, best

text: The concept was piloted for the 1 time in 2022 and it came to stay. Member States’ national coordinators were called to submit their candidatures and upload material on three categories: teaching material;

text: Slovenia &

text: • Best video

text: Belgium, best

text: • Best infographic

text: video.

text: • Best educational material.

text: The winning material was translated in all EU languages and promoted anew within the year’s campaign.

text: ENISA aims to organise this competition every year. The winners - which were announced by VIPs during the ECSM Campaign kick-off – were:

text: • Best infographic: Ireland: Become your own cyber security investigator, announced by European Commissioner Johannes Hahn • Best teaching material: Greece: Treasure hunt games for primary school, announced by European Commission Director for Digital Society, Trust and Cybersecurity, Lorena Boix Alonso.

text: ECSM 2022 CAMPAIGN REPORT

text: • Best video: Slovenia: Darko wants to take his girlfriend on a trip and Belgium: Passwords are a thing of the past. Protect your online accounts with two-factor-authentication, announced by ENISA Executive Director, Juhan Lepassaar.

text: 2.3 ECSM 10 ANNIVERSARY Special th activities were

text: • Anniversary-edition logo: a 10 -anniversary badge was added to the ECSM logo and used in all material and activities of the year prepared for the • 19 MS-members of the ECSM Coordinators’ Group, EUIBAs th

text: Crowdsourcing video: ECSM 10

text: and the people who initiated the ECSM shared their stories and experience from the past 10

text: Anniversary

text: years in a potpourri video, which was aired during the ECSM Interinstitutional Launch event and promoted throughout October. • Thank-you bespoke gifts and cards were created and sent to all contributing MS, EUIBAs & individuals. • Anniversary pop-up: created for the ECSM website. • Interviews and articles were delivered by ENISA on the ECSM story and mission.

text: ECSM 2022 CAMPAIGN REPORT

text: 3. CAMPAIGN DESIGN

text: The ECSM Coordinators’ Group decided that the 2022 campaign would focus on Phishing and Ransomware, as they both are the most prolific threats in Europe and worldwide.

text: In order to maximize results and focus on the audiences that seem most vulnerable, it was decided that the campaigns would target people between the ages of 45 and 65. In particular, the Phishing campaign would focus more on the attacks that these people may suffer in their personal sphere and the Ransomware campaign on employees, as Ransomware is an attack much more directed towards companies.

text: To give the campaigns more “packaging”, the (temporary) motto "Choose To Be Safe Online" was added to the other two ECSM slogans/hashtags, "Think Before You Click" and “CyberSecMonth".

text: Figure 2. Motto Choose To Be Safe Online

text: 3.1 ECSM 2022 THEMES 3.1.1 Phishing

text: According to the ENISA Threat Landscape 2021 , phishing is the most commonly used attack, on its own and as an entry vector for the perpetration of other, larger cyberattacks. It is so common that all of us have encountered it at numerous instances in our everyday lives.

text: The ECSM

text: Moreover, it is a threat with a wide variety of representation, as it can be sent in numerous

text: formats, such as email, instant messages, phone calls, or messages on other instant messaging platforms. Campaign

text: focused on

text: In 2021, the number of phishing attacks tripled, in comparison to the beginning of 2020,

text: Phishing and

text: and in the first quarter of 2022 a new record was set, as it was the first quarter in which

text: Ransomware

text: the number of phishing attacks exceeded one million (at EU level). What is more, phishing is responsible for 90% of data breaches and the most common gateway used by cyber criminals to perpetrate other attacks of greater potential impact, such as ransomware.

text: 3.1.2 Ransomware

text: The need for the creation of a communication campaign on ransomware lies in the fact that the impact and consequences of such attacks are very serious and sometimes even lead to the bankruptcy of companies. The threats posed by ransomware have continued to grow, advance and develop along with technology, and increasingly pose an even more sophisticated and damaging risk. In 2021 there was a 234% increase of ransomware in Europe

text: ECSM 2022 CAMPAIGN REPORT

text: and the average downtime after a ransomware attack is 21 days. The theme was heavily related with the ENISA Ransomware Threat Landscape published in October 2021 .

text: 3.2 ECSM 2022 TARGET AUDIENCE PERSONAS

text: From the outset, it was clear that the campaign would focus on the so-called “digital immigrants". These are people who make extensive use of technology, but whose technology literacy is assumed and expected to be lower than that of the rest of the population. In addition, not many cybersecurity awareness campaigns focus on them, leaving them largely untouched.

text: It was therefore decided that the target audience for the phishing campaign would be the population between 45-65 years of age.

text: The target audience of the ransomware campaign would also be people 45 to 65, but this time employees of European companies and large organisations.

text: 3.3 ECSM 2022 COMMUNICATION CHANNELS

text: Various communication channels were used for this ECSM campaign:

text: • Landing pages within the ECSM website for each of the campaigns, where all the materials produced were made available. th • The ECSM website (https://cybersecuritymonth.eu/) for the promotion of its 10 anniversary. • Organic (Facebook & Twitter) and paid (Facebook, Twitter & YouTube) social media posts for the promotion of both campaigns and anniversary activities. • A new hashtag #Choose2BeSafeOnline was added to the existing ones, in order to increase distribution potential. • All content was created and produced in English and subtitled in all EU official languages, to increase the potential impact of the message in non-English-speaking countries.

text: ECSM 2022 CAMPAIGN REPORT

text: 4. CAMPAIGN EXECUTION

text: 4.1 CONTENT CALENDAR

text: The campaign was structured around a content calendar for social networks, which was communicated to the MS prior to its start, so that they would also follow it alongside ENISA. The first half of October was dedicated to phishing and the second half to ransomware, with initial posts being made as follows and new content being published daily on all channels, afterwards.

text: • 21-28 September: teasers • 30 September: pre-launch • 1 October: launch alongside airing of the Anniversary Video • 2 October: second launch posts.

text: 4.2 LAUNCH OF THE ECSM 2022

text: On Sep 27, the European Cybersecurity Month kick-off event was organised by the EU Council, titled: “A decade promoting cybersecurity awareness”. The event was structured around two sessions:

text: • Growing ransomware trends: are the EU institutions ready? A high-level political debate on the impact of growing ransomware trends, the preparedness of the EU institutions, and the forthcoming Cybersecurity Regulation - against the background of increasing hybrid threats. • Cybersecurity awareness inside the EU institutions The debate on cybersecurity translates into concrete programmes for the EU institutions, bodies and agencies, as they aim to increase awareness among their staff. This session focused on testimonials and best practices with an aim to inspire organisations to up their game.

text: On Sep 30 a Press release was published simultaneously across the EU, announcing the launch of the European th Cybersecurity Month 2022 and the celebration of its 10 anniversary. Special video messages were delivered by EC officials: European Commission Vice-President for Promoting our European Way of Life Margaritis Schinas, European Commissioner for Competition Margrethe Vestager, European Commissioner for Internal Market and Services Thierry Breton, European Cabinet of Commissioner for Financial Budget Juhannes Hahn, Director for Digital Society, Trust and Cybersecurity in Directorate General for Communications Networks Content and Technology (DG CONNECT) Lorena Boix Alonso and ENISA Executive Director, Juhan Lepassaar, who also announced the winners of the ECSM Awards.

text: 4.3 CAMPAIGN MATERIALS AND SOCIAL MEDIA CONTENT

text: ECSM 2022 materials were developed around the “Choose to Be Safe Online” concept, illustrated in the image of a shield that transforms into a human firewall,

text: Figure 3. “Choose To Be Safe Online” concept

text: and included the following:

text: ECSM 2022 CAMPAIGN REPORT

text: • Landing pages were created on the ECSM website. They were used as platforms to deploy a story for each theme and included all related materials. • Social media images: a series of social media posts and one accompanying video, images, and infographic. • Infographics: three infographics per theme, providing insight to the current cybersecurity status in Europe. • Downloadable posters raising awareness on the threats of phishing and ransomware. They were translated into 24 languages which resulted in a total of 150 versions in both PDF and editable, open format. • "Prevention Response for Ransomware Attacks" downloadable handbook: a comprehensive document for managers of small and medium sized organizations to distribute to their employees and train them on how to prevent and deal with a ransomware attack. • Ambassadors’ kit.

text: Materials produced per theme:

text: • 1 main video • 3 complementary videos (capsules) • 3 illustrations with statistical data • 8 illustrations with the main tips to protect oneself against phishing and ransomware • 3 downloadable posters • 3 Photos • 1 quiz • Infographics • 1 post linking to the Cyber First Aid map.

text: Additionally, for the 10-year anniversary:

text: • A 14-minute video was produced via crowdsourcing testimonials from Member States, EU Agencies and individuals who contributed to the ECSM over the years. • th A 10 -anniversary badge was added to the ECSM logo. • Special social media posts. • Engraved gift and thank-you card.

text: ECSM 2022 CAMPAIGN REPORT

text: 5. CAMPAIGN EVALUATION

text: 5.1 EVALUATION METHODOLOGY

text: The ECSM 2022 campaign was evaluated on the basis of the following:

text: • Member State activities: each Member State provided their campaign “history”, including Partnerships and Ambassadors, target audience (if different from the general one), all national events and activities within the ECSM framework, material used, their own results and conclusions, etc. • ENISA central social media activities: total number of mentions, total number of followers & their demographic data, top keywords, top hashtags, paid post results, etc. • ECSM Web Analytics: number of visits, unique visitors, views, actions per visitor, time spent per visit, number of downloads, • Events: time, place & theme of national events and activities within the ECSM. • Media monitoring: each Member State provided statistics for all the channels or media used during their campaign. • Evaluation Questionnaire: qualitative assessment of MS perceptions about the ECSM campaign.

text: 5.2 MS QUESTIONNAIRE

text: Participating Member States were asked to fill-in an 11-question feedback survey as well as data reports, to improve European Cybersecurity Month efforts and coordination:

text: 1. How would you rate the overall implementation of the ECSM 2022 campaign? (scale 1-10)

text: 2. Did ECSM 2022 support the outreach and promotion of your work in a satisfactory manner?

text: 3. Did ECSM add value to your national campaign?

text: 4. Did ECSM offer opportunities for improving your national campaigns through collaboration with other

text: countries?

text: 5. Do you think ENISA succeeded in sharing and promoting new ideas among ECSM partners?

text: 6. Did the content (videos, infographics, GIFs etc.) produced by ENISA for the ECSM support your

text: national campaign?

text: 7. How would you rate the content produced for the ECSM 2022 campaign? (scale 1-10)

text: 8. Could ENISA promote your awareness material better?

text: 9. Do you think the ECSM offers opportunities for fostering a pan-European cybersecurity culture?

text: 10. How would you rate the implementation of the ECSM 2022 by ENISA? (scale 1-10)

text: 11. How likely are you to recommend partnering with ENISA on the ECSM next year to another organisation

text: like yours on a scale from 1 to 10, where 1 is not at all likely and 10 is extremely likely?

text: Table 1. MS Questionnaire

text: Overall, their responses yielded the following results:

text: 1. The ECSM 2022 campaign was rated with an average of 7.5. 2. 85,7% MS state that the ECSM 2022 supported the outreach and promotion of their work.

text: ECSM 2022 CAMPAIGN REPORT

text: 3. 85% MS believe that the ECSM added value to their national campaigns and that ENISA did a good job in promoting and sharing new ideas with its partners. 4. 75% answered that the ECSM offered opportunities to improve their national campaigns. 5. 90% stated that ENISA succeeded in promoting and sharing new ideas among ECSM partners.

text: MS feedback for

text: 6. 80% indicated that the content created by ENISA for the ECSM supported their national

text: campaigns. the ECSM 2022

text: 7. The average content rate for the ECSM materials created by ENISA was 7,2. Campaign was 8. 100% MS feel that ENISA offers opportunities for fostering a pan-European cybersecurity

text: positive, with

text: culture.

text: most variables

text: 9. With the exception of 2 countries, all MS would recommend partnering with ENISA on

text: scoring above

text: ECSM next year. 10. The net promoter score was 38. 80%

text: Additionally:

text: • 84% of MS assess that the ECSM campaign had an impact on the reduction of cyber incidents. • The majority of MS perceived that the change in attitude after the implementation of the ECSM campaign was more positive. • Campaign’s main strength: the materials created and the collaboration between the MS and ENISA. • Campaign’s main weakness: contents are very concentrated in October - users need more materials throughout the year. • Average score of 7.1 for the effectiveness of the ECSM 2022 campaign to raise the belief that cybersecurity behaviours can actually prevent cybersecurity threats. • Average score of 6.2 for campaign effectiveness in changing the perception that security compliance is a waste of time and not very productive.

text: 5.3 ASSESMENT OF WEB RESULTS 5.3.1 ECSM website

text: The metrics indicate a very high level of awareness and that all objectives set for the period were met and exceeded. Users of the

text: ECSM website

text: • Visits to ECSM website increased over the previous period by an average of 27%,

text: interacted much

text: with the total visits being 31.8% more.

text: more with its

text: • Visitors stayed 6.7% longer on the ECSM website and the bounce rate was reduced

text: content than

text: by almost 12%.

text: • previous year.

text: In October 2022, the ECSM website had 28.3% more page views than the monthly average of 2021.

text: • Downloads of materials increased by almost 10% and out links increased by 78%. • The most visits were made during weekdays. • 76% of the traffic flow to the ECSM website was generated by social media posts on Facebook, Twitter, LinkedIn and YouTube. • ECSM website: 53% of users were redirected from Facebook, 10% from Twitter, 9.6% from LinkedIn, and 5.7% from YouTube.

text: 5.3.2 Cyber First Aid Map

text: The ECSM Cyber First Aid Map was included in this year’s campaign too, as it provides users with information about the organisations to contact in case of a cyber incident, according to their geolocation. A link to the map was embedded in the landing pages for the two themes.

text: ECSM 2022 CAMPAIGN REPORT

text: Figure 4. Cyber First Aid Map link

text: 5.3.3 Media monitoring

text: To improve the impact on offline channels, a press release dedicated to the Ten Years of Raising Cyber Awareness Throughout Europe was published.

text: This press release had a significant impact in the media, owing to the use of hashtags dedicated to improving messages.

text: As a result, some 2,288 appearances in press media were found in the press clipping with a total daily audience of 675,155,981 readers. The impact in these media would have an advertising value of 7.5 million euros.

text: More facts about the press release:

text: • Keywords: A SEO strategy was set originally, containing the keywords below to undermine the text:

text: − European Cybersecurity Month − #CyberSecMonth − #ThinkB4UClick − #Choose2BeSafeOnline − ENISA

text: • Period: The analysis period used for the follow-up of the press release was approximately two months. It was not limited to October, i.e. the period immediately after its release but stretched to November as well. With this technique, it was possible to find a correlation between the increase in the organisation’s shares and the exposure of the press release on the European Cybersecurity Month website.

text: • Territories: The following countries were analysed: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden.

text: • Press Sentiment: According to the subject matter of the content and the algorithm's capacity to identify details of tone, 947 posts were

text: identified as positive tone, 1125 were identified as neutral tone and 141 were negative.

text: ECSM 2022 CAMPAIGN REPORT

text: Figure 5. Press Clipping Sentiment

text: • Keywords’ Distribution The keywords were distributed as follows:

text: Figure 6. Main Press Clipping Keywords

text: 5.3.4 Social media

text: ECSM 2022 campaign content was published through organic and paid media, and on three social media platforms, Twitter, Facebook and YouTube.

text: Noteworthy findings include the following:

text: • Overall activity came from many different countries.

text: A sustained

text: • The total follower growth achieved by ENISA, from 2021 to 2022, was 9.6% for Twitter and 16% for Facebook. growth on • Total Reach: despite having less visibility, 2022 content achieved greater user social media

text: engagement. was observed

text: • Interaction on Twitter was consistently higher than on Facebook in volume.

text: throughout the

text: • The platform with the lowest number of interactions in the form of “likes” was YouTube.

text: campaign

text: • Interactions with the content were higher during weekdays than in the weekend. • #CyberSecMonth hashtag appeared to be the most represented. • Most Twitter users (11K) were located or based in European countries. • A big number of users who interacted with the website were based in the United States. • A total of 4K users interacted with the web pages.

text: ECSM 2022 CAMPAIGN REPORT

text: • Trend topics

text: Figure 7. Trend topics

text: • Paid posts: − Higher granularity led to higher results, compared to ECSM 2021 (i.e., this year different campaigns were created, one for content, one for videos & one for each country). − Campaign total: 18,142,291 impressions, on all social networks. − Five times more views achieved for the content on social networks, reaching a total of 5,913,475 views. − 47,892 total social media clicks = more people came to the website redirected from social media (vs accessing it directly). − Users stayed longer on the website and interacted more with the content than last year. −

text: Figure 8. Social Media Views & Clicks

text: • Campaign Audience:

text: Figure 9. Campaign Audience

text: ECSM 2022 CAMPAIGN REPORT 5.4 BEHAVIOURAL CHANGE ANALYSIS

text: In the context of the ECSM 2022 campaign, ENISA launched, for the first time, a pre and post campaign survey to measure the resulting behavioural change and impact. In brief, the following results and recommendations were drawn from the study:

text: Results

text: • The studied sample reported higher engagement in cybersecurity behaviour (self-reported cybersecurity behaviour) after the campaign, than that reported by the sample before the campaign. • Respondents who declared to have seen information related to the campaign’s themes were observed to score higher on cybersecurity behaviour score than respondents in the pre-campaign phase. • The higher the intentions towards performing cybersecurity behaviour, the more likely people are to perform it. • In order to increase vulnerability, it is important to increase awareness about cyber threats and focus on the efficacy of users’ actions. • When people think that performing appropriate security behaviours to protect their data is a good idea, a necessity or beneficial, this translates into a willingness to perform the behaviour and, in the end, to execute it. • When respondents believed that their immediate environment - such as friends, family, colleagues and managers - think they should follow cybersecurity guidelines, it makes them more likely to adhere to them. • Performing cybersecurity behaviour compliant with guidelines depends on people’s perceptions of cybersecurity. • People’s perception of how effectively a response can prevent a threat and their confidence in their skills greatly contributes to the willingness to perform cybersecurity behaviour. • Normative beliefs were found to be a key factor for cybersecurity behaviour. • The campaign’s target audience - people over 45 years old – were observed to be significantly more likely to perform cybersecurity behaviour compared to younger people. • Cybersecurity behaviour was observed to vary depending on occupation. • Overall, participants indicated that the campaigns helped protect them from “Phishing” slightly more than “Ransomware”.

text: ECSM 2022 CAMPAIGN REPORT

text: 6. CONCLUSIONS & RECOMMENDATIONS

text: Upon analysis of the results presented above, the following conclusions were drawn for the ECSM 2022 Campaign.

text: Of the countries that responded to the survey:

text: • MS participated broadly in the ECSM, by sharing content and organising different activities. • Overall feedback from MS was positive, with most variables scoring above 80%. • Short videos were the type of material that generated the most views and user interactions. • Users of the ECSM website interacted much more with its content, therefore it is deemed that the target audience was reached more efficiently.

text: Regarding social media:

text: • A sustained growth was observed throughout the campaign. • Most of the people who accessed the ECSM website were redirected from the social networks. Therefore, it is considered that dissemination through social media was effective. • The target audience that was receptive to the messages on the social networks was likewise responsive to the contents of the website.

text: Finally, the findings of the behavioural study indicated the factors on which awareness campaigns should forcus, in order to result in far-reaching cybersecurity behaviour compliance:

text: • Inform and inspire audiences by providing real-world examples and illustrating the way cyber threats can affect them, as this helps them understand better and endure being careful and alert in the future. • Provide practical, concise, and easy to execute instructions and advice that individuals can apply in their interactions with software, networks, and information infrastructures. • Facilitate discussion and sharing of information with others, as it was found that nationwide and international campaigns influence the behavior of indivduals but also of people in organisations. • Consider various constructs related to cybersecurity behaviour, when designing campaign and awareness communication, for a comprehensive influence and profound impact. • Critical investigation needs to be undertaken, at an organisational and national level, to understand barriers to motivation, e.g., organisational or technological issues, as well as the level of security culture and risk of insider threat. • When designing campaigns for behaviour change, one must consider the indirect effects of the campaign occurring through word of mouth, as well as the measurable self-reported individual behaviour.

text: None of above factors is sufficient by itself, but their combination can facilitate effective targeting.

text: ECSM 2022 CAMPAIGN REPORT

text: ANNEX

text: 1. ENISA PROMOTIONAL MATERIAL:

text: All material for both campaigns can be found here:

text: Table 2. ENISA Promotional Material

text: 2. VISITS OVER TIME:

text: Figure 10. Visits over time

text: ECSM 2022 CAMPAIGN REPORT 3. GEOGRAPHIC DISTRIBUTION

text: Figure 11. Geographic distribution

text: -3 629 4- -920 -92 978

text: ABOUT ENISA

text: ISBN 978-92-9204-629-3 DOI 10.2824/36758


text: April 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

text: april 2024

identifier: European Cybersecurity Month 2023 - Campaign report

title: European Cybersecurity Month 2023 - Campaign report

text: ECSM 2023 CAMPAIGN REPORT APRIL 2024

text: ECSM 2023 CAMPAIGN REPORT

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: CONTACT

text: For contacting the authors please use ehealthSecurity@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: AUTHORS

text: Marianna Kalenti, Peter Biro (ENISA)

text: ACKNOWLEDGEMENTS

text: S2 Grupo, Kill Draper

text: LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2024

text: This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.

text: For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN 978-92-9204-665-1 DOI 10.2824/005990

text: ECSM 2023 CAMPAIGN REPORT

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 5

text: 1.1 COMMUNICATION PLAN & DEPLOYMENT 5

text: 1.2 CONTENT CREATION 5

text: 1.3 INTERACTIVE ENGAGEMENT 5

text: 1.4 YEAR-ROUND CAMPAIGN 5

text: 2. CAMPAIGN OVERVIEW 6

text: 2.1 CREATIVE UMBRELLA: "BE SMARTER THAN A HACKER" 6

text: 2.2 CAMPAIGN ACTIVITIES AND PERFORMANCE 6

text: 2.3 TARGET GROUP AND CHANNELS 6

text: 2.3.1 Target Group 6 2.3.2 Campaign Promotion Channels 6 2.3.3 Impact Assessment and Feedback Collection 7

text: 2.4 MAIN CREATIVE AWARENESS SONG 7

text: 2.4.1 Collaborative Creation Process 7 2.4.2 Impact and Engagement 7

text: 3. CAMPAIGN MIX 8

text: 3.1 UMBRELLA CONCEPT: "BE SMARTER THAN A HACKER" 8

text: 3.2 WEBSITE LANDING 8

text: 3.3 RED FLAG VIDEOS 9

text: 3.4 CAMPAIGN CONTENT CALENDAR 10

text: 3.5 DOWNLOADABLE POSTER 10

text: 3.6 CYBERCRIMINAL PROFILE VIDEO 11

text: 3.7 INFOGRAPHIC 12

text: 3.8 SOCIAL MEDIA IMAGES 12

text: 3.9 HELPFUL TIPS 13

text: 3.10 QUIZ TIME 13

text: ECSM 2023 CAMPAIGN REPORT

text: 3.11ECSM AWARDS 14

text: 4. ECSM IN NUMBERS 15

text: 4.1 ENGAGING COMMUNICATION MIX 15

text: 4.2 ENGAGING MEMBER STATES 24

text: 5. CONCLUSIONS & RECOMMENDATIONS 28 ECSM 2023 CAMPAIGN REPORT

text: EXECUTIVE SUMMARY

text: European Cybersecurity Month (ECSM) 2023 took a different approach than in 2022. ENISA decided to take cybersecurity awareness to a different level, transforming the original ECSM campaign, which used to take place only during October, into a yearlong communication plan and strategy.

text: The ECSM 2023

text: The 2023 ECSM celebrated cybersecurity and awareness throughout the entire year. To do so, focused on ENISA worked together with the Coordinators’ Group to decide on the road map for the new Social strategy. Several meetings took place, and the Annual plan was decided. Various mini

text: Engineering and

text: campaigns were launched during the year, coinciding with special commemorative days related

text: was aimed at the

text: to cybersecurity. In addition, October took most of the focus, with numerous videos, illustrations,

text: general public.

text: etc., which were tailor-made and produced to target the 2023 topics and audiences.

text: Also in cooperation with the Coordinators’ Group, it was determined that the 2023 campaign should focus on Social Engineering for the general public. Once the decision was made, ENISA started working on a communication plan and ideas for the deliverables.

text: Overall, and even though ENISA’s ECSM 2023 campaign did not include paid media and relied only on organic posts, the results exceeded expectations and achieved the desired

text: objectives. The overall performance yielded better numbers than past campaigns, which, by contrast, did employ paid social media.

text: Posts reached the target audience, raising awareness about the risks of social engineering for the general public. Contents (particularly photographs, which performed better than other formats) generated interest and engaged the audience attracting new followers on ENISA’s social media profiles, potentiating its media presence.

text: ECSM 2023 CAMPAIGN REPORT

text: 1. INTRODUCTION

text: The European Cybersecurity Month (ECSM) 2023 took place throughout the entire year and focused most of its efforts in October. The campaign commenced on the 1st and spanned the entire month, concluding on the 31st. This year's central theme focused on the critical subject of Social Engineering. The campaign strategy integrated various communication methods, educational materials, interactive quizzes, and downloadable resources across multiple social media platforms including Facebook, Instagram, and Twitter.

text: The ECSM 2023 1.1 COMMUNICATION PLAN & DEPLOYMENT took

text: • Developed a comprehensive communication strategy tailored to the theme of Social cybersecurity Engineering.

text: awareness to a

text: • Utilised diverse communication channels such as original video content, website design,

text: new level,

text: image-based educational materials, videos, quizzes, and downloadable resources. • Targeted dissemination across Facebook, Instagram, and Twitter throughout the month of expanding the October to reach a broad audience. scope of the

text: campaign to the 1.2 CONTENT CREATION entire year.

text: • Produced an original video to enhance engagement and disseminate essential cybersecurity insights. • Designed an intuitive website interface to provide centralised access to educational materials and resources. • Created a range of visually appealing educational materials, including images and videos, to convey cybersecurity awareness effectively.

text: 1.3 INTERACTIVE ENGAGEMENT

text: • Developed an awareness-raising quiz to engage the audience and promote understanding of cybersecurity threats and best practices. • Offered downloadable resources to encourage continued learning beyond the campaign period.

text: 1.4 YEAR-ROUND CAMPAIGN

text: In addition to the month-long ECSM campaign, a year-round initiative was introduced. This ongoing effort included themed campaigns tailored for each month, catering to various cybersecurity aspects and broader digital safety concerns:

text: • Internet Day: Highlighted the significance of safe and responsible internet usage. • Data Protection Day: Focused on the importance of safeguarding sensitive data. • Backup Day: Emphasised the necessity of regular data backups for protection against cyber threats. • World Password Day: Raised awareness about strong password creation and management. • World Social Media Day: Advocated for safe and responsible social media practices. • Sys Admin Day: Acknowledged the crucial role of system administrators in maintaining cybersecurity. • Summer Tips: Offered specific cybersecurity tips tailored for the summer season. • Black Friday: Alerted users about potential cyber threats during high-traffic shopping events. • Health: Highlighted cybersecurity aspects related to healthcare data protection and privacy.

text: ECSM 2023 CAMPAIGN REPORT

text: 2. CAMPAIGN OVERVIEW

text: 2.1 CREATIVE UMBRELLA: "BE SMARTER THAN A HACKER"

text: The campaign's creative umbrella, "Be Smarter than a Hacker," serves as a powerful reminder emphasising the significance of vigilance and discernment while engaging online. This claim effectively resonates due to several key reasons:

text: • Awareness of the Threat: It amplifies the understanding of the omnipresent threat posed by hackers and social engineering tactics. This heightened awareness is crucial for individuals to recognise potential risks. • Personal Empowerment: The claim instils a sense of personal empowerment, emphasising that individuals possess the capability to protect themselves by being vigilant and informed in their online interactions. • Encouragement of Caution: It promotes a cautious mindset, encouraging individuals to exercise prudence and critical thinking, thus reducing susceptibility to social engineering tactics. • Promotion of Education and Awareness: By fostering a culture of education and awareness, the claim encourages continuous learning and knowledge acquisition in cybersecurity matters.

text: "Be Smarter than a Hacker" serves as an effective rallying cry against social engineering techniques. It motivates individuals to exercise caution, empowers them to take control of their online interactions, and emphasises the ongoing importance of education and awareness in combating cyber threats.

text: 2.2 CAMPAIGN ACTIVITIES AND PERFORMANCE

text: The campaign activities implemented during the ECSM encompassed a range of content formats tailored to engage and educate audiences across Europe. This report will delve into the specifics of each activity, evaluating their individual performance and impact in raising cybersecurity awareness among the targeted demographic.

text: 2.3 TARGET GROUP AND CHANNELS 2.3.1 Target Group

text: The European Cybersecurity Month (ECSM) campaign aligned with expectations, targeting the general public with a deliberate focus on ensuring inclusivity and relevance across diverse demographics.

text: 2.3.2 Campaign Promotion Channels

text: Social Media Engagement: Leveraged popular social media platforms including Facebook, Instagram, and Twitter to disseminate campaign content. These channels facilitated widespread outreach, engaging audiences across varied age groups and interests.

text: Online Survey Distribution: Deployed an online survey that was distributed among Member States to gather valuable insights and feedback. This approach allowed for the collection of diverse perspectives and opinions, enhancing the campaign's adaptability and relevance.

text: ECSM 2023 CAMPAIGN REPORT 2.3.3 Impact Assessment and Feedback Collection

text: The utilisation of social media channels enabled a broad reach and engagement across different demographics, ensuring the campaign's message reached a wide audience.

text: The inclusion of an online survey distributed among Member States was a proactive measure to gather feedback, perceptions, and experiences regarding cybersecurity awareness. This feedback loop provided valuable insights for future campaign improvements and content refinement.

text: The campaign's strategic choice of targeting the general public along through social media platforms and online surveys showcases a commitment to inclusivity and comprehensive engagement. The data collected through these channels will be instrumental in assessing the campaign's effectiveness and tailoring future initiatives for heightened impact.

text: 2.4 MAIN CREATIVE AWARENESS SONG

text: For the European Cybersecurity Month (ECSM) campaign, a strategic decision was made to cater to a diverse target group by creating a unifying musical piece accessible to all audiences. To achieve this, a contest was initiated involving six different musicians representing varied musical styles ranging from folk, Afro, indie, to big band.

text: 2.4.1 Collaborative Creation Process For the ECSM

text: Contest and Musical Diversity: The contest facilitated collaboration with musicians spanning

text: 2023 we created

text: diverse genres, ensuring representation across a broad spectrum of musical tastes and

text: an awareness

text: preferences. This approach aimed to resonate with a wide range of audience demographics.

text: song about Social

text: Global Collaboration: Musicians from around the world came together, contributing their Engineering unique styles and cultural influences. This global collaboration not only diversified the musical threats using our composition but also promoted a sense of inclusivity and unity across borders.

text: main umbrella concept “Be

text: Musical Video Clip Creation: Through this collaborative effort, a main song was composed, incorporating elements from various musical styles into a cohesive musical piece. This main Smarter than a song served as the centrepiece for a visually engaging musical video clip, combining creativity, Hacker” to better diversity, and cybersecurity awareness messaging. impact and

text: engage the 2.4.2 Impact and Engagement targeted public

text: The collaborative creation of the main song provided to the diverse tastes and preferences of the ECSM campaign's wide-ranging target audience, ensuring resonance with various demographic groups.

text: By fusing multiple musical styles into a unified piece, the campaign aimed to capture attention and engage audiences through a creative and memorable musical experience, enhancing the overall impact of the cybersecurity awareness message.

text: The creation of a collaborative song involving musicians from different genres and regions demonstrates an innovative and inclusive approach to engaging diverse audiences. This musical endeavour aimed not only to raise awareness about cybersecurity but also to connect with individuals on a universal and emotional level through the medium of music.

text: ECSM 2023 CAMPAIGN REPORT

text: 3. CAMPAIGN MIX

text: Consult entire campaign here: https://cybersecuritymonth.eu/smarterthanahacker

text: 3.1 UMBRELLA CONCEPT: "BE SMARTER THAN A HACKER"

text: To anchor efforts in raising awareness about social engineering, the ECSM centred its campaign on the concept of "Be Smarter than a Hacker." This thematic core was visually represented by a clever thinking bubble image, designed to be both witty and insightful.

text: Illustration 1. 2023’s ECSM campaign logo

text: 3.2 WEBSITE LANDING

text: To broaden the dissemination of the message, ENISA strategically employed a landing page as the central platform for the narrative deployment. This accurately crafted landing page served as a gateway for users, granting access to a compelling array of content, including four original musical videos, a comprehensive series of tips and tricks to identify social engineering, downloadable posters, an interactive quiz to gauge individual knowledge levels, and facilitated access to a cybersecurity kit.

text: Illustration 2. 2023’s ECSM campaign landing page

text: ECSM 2023 CAMPAIGN REPORT 3.3 RED FLAG VIDEOS

text: ENISA developed three distinct red flag videos specifically designed to highlight key indicators of social engineering tactics. These videos were focused on recognising and addressing unexpected requests, unbelievable offers, and urgency—key elements that often signal potential social engineering attempts.

text: Illustration 3. 2023’s ECSM campaign Red Flag Video: Unexpected requests

text: Illustration 4. 2023’s ECSM campaign Red Flag Video: Unbelievable offers

text: Illustration 5. 2023’s ECSM campaign Red Flag Video: Urgency

text: ECSM 2023 CAMPAIGN REPORT 3.4 CAMPAIGN CONTENT CALENDAR

text: The campaign was precisely organised using a content calendar tailored for social networks. This structured approach ensured a comprehensive presentation of social engineering topics alongside educational videos, crucial tips, downloadable materials, engaging quizzes, and more. This strategic scheduling optimised the delivery of diverse and informative content to our audience across various social media platforms.

text: The Open ECSM sub-campaign was an initiative that urged individuals to actively participate by sharing their own experiences and insights related to social engineering on their personal social media channels. This engagement-driven sub-campaign aimed to foster a community-driven dialogue, encouraging the sharing of valuable knowledge and personal encounters with social engineering tactics among peers and networks.

text: The year-round campaign was meticulously structured around a series of diverse themes spanning the calendar year. Each month was dedicated to a specific theme aimed at addressing various aspects of cybersecurity and digital safety. These themes included Internet Day, Data Protection Day, Backup Day, World Password Day, World Social Media Day, Sys Admin Day, Summer Tips, Black Friday, and Health. This strategic approach allowed for a continuous and targeted focus on different facets of cybersecurity, ensuring a sustained and comprehensive awareness effort throughout the year.

text: 3.5 DOWNLOADABLE POSTER

text: The downloadable poster serves as a vital tool in raising awareness about the often-overlooked threats posed by social engineering. Crafted to inform and educate, these posters are available in both original PDF formats and editable open formats. It aims to enlighten individuals about the subtleties of social engineering tactics, empowering them with knowledge and actionable insights to better safeguard themselves against potential cyber threats.

text: Illustration 6. 2023’s ECSM campaign downloadable poster

text: ECSM 2023 CAMPAIGN REPORT 3.6 CYBERCRIMINAL PROFILE VIDEO

text: The animated video was carefully created to illuminate the profile of social engineering criminals. This engaging and informative video utilised animation to vividly portray the characteristics and behaviours of cybercriminals employing social engineering tactics. Its primary focus was on educating viewers about the key identifiers and traits associated with these deceptive individuals, empowering the audience to recognise and guard against potential threats posed by such cybercriminals.

text: Illustration 7. 2023’s ECSM campaign cybercriminal profile video

text: ECSM 2023 CAMPAIGN REPORT 3.7 INFOGRAPHIC

text: The creation of two impactful infographics on social engineering was aimed at raising awareness and highlighting the severity of these threats. These visually engaging infographics incorporated updated data, offering a comprehensive snapshot of the current cybersecurity landscape in Europe. Designed to serve as informative resources, they provide valuable insights for anyone seeking a deeper understanding of social engineering, contributing to a broader knowledge base on this critical cybersecurity topic.

text: Illustration 8. 2023’s ECSM campaign infographics

text: 3.8 SOCIAL MEDIA IMAGES

text: The campaign encompasses a diverse array of engaging content customised for social media platforms, including a compelling video, visually captivating images, and an informative infographic. These thoroughly crafted materials are strategically organised to encourage active participation in the European Cybersecurity Month campaign. Their purpose is to spark interest, stimulate discussions, and motivate individuals to get involved in promoting cybersecurity awareness throughout the month.

text: ECSM 2023 CAMPAIGN REPORT 3.9 HELPFUL TIPS

text: The initiative included the development of a set of ten valuable tips specifically aimed at aiding individuals in identifying social engineering tactics. These curated tips were designed to equip the audience with practical knowledge and actionable guidance, empowering them to recognise and thwart potential social engineering attempts effectively.

text: Illustration 9. 2023’s ECSM campaign tips

text: 3.10 QUIZ TIME

text: The creation of a simulated social engineering email attack served as an interactive and educational quiz designed to evaluate the cybersecurity preparedness of the target audience of the ECSM campaign. This simulation provided a hands-on experience, allowing individuals to gauge their ability to identify and respond to potential social engineering email attacks, ultimately enhancing their cybersecurity awareness and preparedness.

text: Illustration 10. 2023’s ECSM campaign quiz

text: ECSM 2023 CAMPAIGN REPORT 3.11 ECSM AWARDS

text: During the ECSM 2023 campaign, the ECSM Awards ceremony unfolded, showcasing excellence in three distinct categories: Video, Educational Material, and Infographics.

text: The Awards video segment was streamed online, featuring precisely recorded and edited content. The finalised video was strategically launched on the day of the event, accompanied by a well-crafted press release for widespread dissemination.

text: Illustration 11. 2023’s Awards Ceremony

text: ECSM 2023 CAMPAIGN REPORT

text: 4. ECSM IN NUMBERS

text: 4.1 ENGAGING COMMUNICATION MIX

text: The communication mix for the European Cybersecurity Month (ECSM) 2023 campaign

text: did not employ any paid social media, therefore it had to rely only on organic posts. Thus, the ECSM 2023 was strategically crafted to overcome this fact and embody traits of engagement, boldness, and playfulness. This deliberate approach aimed to provoke contemplation and discussion about the critical digital security issue of social engineering.

text: Table 1. ECSM 2023 in numbers

text: The ECSM 2023 campaign has introduced, as mentioned earlier, the innovation of distributing posts throughout the entire year, logically increasing the number of publications in October in line with the observance of Cybersecurity Awareness Month.

text: ECSM 2023 CAMPAIGN REPORT

text: Upon a comprehensive analysis of the results from all the posts made across various

text: platforms or social media throughout this year, it is observed that the content has been

text: The ECSM 2023

text: displayed 134k times. Out of these instances, 104k users have effectively viewed these

text: campaign content

text: posts. Furthermore, more than 2k interactions have taken place with the content, including sharing, liking, or reacting to the posts. was effectively

text: viewed by 104k users.

text: Figure 1. Posts impressions and reach

text: If we examine the number of posts made on different platforms, the following is evident.

text: Facebook has been the most utilised social media platform, with 112 posts. This is

text: followed by Instagram with 69 posts, and Twitter with 35.

text: Figure 2. Number of posts on each social media channel

text: Twitter, being the social media platform with the uppermost number of followers, has

text: generated the highest number of impressions despite sharing the least content. Specifically, the content posted on Twitter has been displayed 129K times, 1.25 times more than on Facebook and 58.64 times more than on Instagram.

text: However, the number of reactions and likes, which could be considered as a benchmark for calculating real user engagement with the content, has not shown as much disparity across Twitter and the other platforms. In fact, Facebook has achieved 1.57 times more reactions and likes (with a total count of 804) than Twitter (with a total count of 512) (the reasons for this difference will be analysed below).

text: Facebook has also garnered a very high number of impressions. When comparing the

text: significant difference in the number of followers between Twitter and Facebook—almost

text: 17 times more followers on Twitter than on Facebook (with Twitter having 32K and

text: ECSM 2023 CAMPAIGN REPORT

text: Facebook 1.9K followers)—it is noteworthy that the number of impressions is not as disparate (1.25 times more on Twitter than on Facebook), with Twitter obtaining 129K impressions and Facebook locating 103K.

text: This could be attributed to various factors. Certainly, the difference in the number of posts made on each platform has influenced this outcome (with a higher number of posts on Twitter than on Facebook). However, it is also plausible, although not conclusively stated, that

text: this data is supported by the general engagement of users being higher on Facebook

text: than on Twitter, indicating a more loyal following on the former platform. This second conclusive hypothesis is further supported by the fact that Facebook has achieved a higher number of reactions and likes, as mentioned in the previous paragraph.

text: It's worth noting that the Instagram account was created in 2023, so it's logical that it has fewer followers, and the loyalty of these followers may be lower than on other platforms. However, despite having only 114 followers, it has generated 2.1k impressions and

text: obtained a number of reactions and likes that is not significantly different from the achievements on other platforms—only 2.4 times less than Facebook and 1.52 times less

text: than Twitter. Instagram has managed to gather 336 reactions compared to the 512 on Twitter and 804 on Facebook.

text: Figure 3. Comparing numbers and social media channels

text: Analysing the type of content that has performed best on social media during the ECSM 2023 campaign, photographs or illustrations are the format with the best functioning.

text: • The type of content that has been seen by the largest number of people (with a reach of 57k) and has generated the most interest, obtaining 755 clicks, has been photos or illustrations. • The second most engaging content (with a total of 152 clicks) has been albums, despite being seen by five times fewer users than videos (albums had a reach of 6.4k, while videos had a reach of 32k). • The third most engaging content has been videos. It's noteworthy here that despite having a 32% reach, they only obtained 12% of the clicks. • The type of content that generated the least interest, with the lowest reach and the fewest clicks, has been links.

text: ECSM 2023 CAMPAIGN REPORT

text: Figure 4. Clicks and reach sorted by media type

text: If we examine which specific posts have generated the most interest, the following observations emerge:

text: On Facebook, the post that has elicited the highest number of reactions is the kick-off for the Cybersecurity Awareness Month, followed by posts published on specific days related to cybersecurity—particularly, Systems Administrators Day and World Password Day. On these days, specific content was shared to commemorate these occasions.

text: Illustration 12. Top 3 posts on Facebook

text: Following this ranking of the top three highlighted posts on Facebook, the subsequent posts are listed in descending order based on the general interest they have generated on the mentioned platform.

text: ECSM 2023 CAMPAIGN REPORT

text: Illustration 13. Top 12 posts on Facebook

text: On Twitter, we observe that the tweet generating the most interaction or interest (engagement) is the one dedicated to downloading the October campaign poster under our umbrella concept "Be Smarter Than a Hacker”. The second most engaging tweet is the one precisely created for the Annual Awareness Raising Awards ceremony celebrating Slovenia's video victory. The third post that has harvested significant interest is the one referring to Switzerland's adaptation of the Be Smarter Than a Hacker song, produced specifically for this campaign.

text: ECSM 2023 CAMPAIGN REPORT

text: Illustration 14. Top 3 posts on Twitter

text: Following this top three of tweets, the subsequent tweets are arranged from highest to lowest based on the general interest they have generated on the platform.

text: Illustration 15. Top 12 posts on Twitter

text: On Instagram, the posts that have performed best are also related to the Be Smarter Than a Hacker song. The adaptation from Switzerland has generated the most interest, followed by the English version of the song created for the campaign (from which the adaptation stems). The third post that has sparked considerable interest is the one about unexpected request to protect yourself from social engineering attacks.

text: In contrast to the analysis conducted earlier, on Instagram, we observe that the type of content that works best for this platform and audience is videos.

text: ECSM 2023 CAMPAIGN REPORT

text: Illustration 16. Top 3 posts on Instagram

text: After this top three of posts on Instagram, the subsequent posts are also ordered from highest to lowest based on the general interest they have generated on the platform.

text: ECSM 2023 CAMPAIGN REPORT

text: Illustration 17. Top 12 posts on Instagram

text: ENISA’s social media presence

text: Having analysed the statistics based on the published posts, it is now crucial to study and understand how this year-long campaign has impacted ENISA's social media presence. This is has been examined by assessing the number of followers on each platform and how these numbers have reinforced with an either grown or decrease throughout 2023. increase in

text: followers during

text: The total count of followers across all social media platforms directly and proactively

text: the ECSM 2023

text: utilised by ENISA during the ECSM 2023 campaign is 34k users. This marks an increase compared to the previous year, with a gain of 481 new followers. campaign

text: The distribution of these followers is uneven. As observed in the earlier analysis, the @CyberSecMonth Twitter account boasts a total of 32k followers, while on Facebook, there are 1.9k followers (almost 17 times fewer than on Twitter). Meanwhile, on Instagram, there are 114 followers (equating to 280 times fewer followers than on Twitter and nearly 17 times fewer than on Facebook).

text: Figure 5. Followers by social media channel

text: The followers on Facebook have been steadily increasing uniformly throughout the entire year until October, where the growth surges and becomes more noticeable.

text: This trend indicates that the decision to extend the campaign across the entire year has yielded positive outcomes in effectively boosting both the number of followers and their engagement with ENISA's cybersecurity awareness initiatives.

text: As previously mentioned, the uniformity in the dispersion of the follower growth curve is disrupted in October, aligning with the cybersecurity awareness month campaign. This lines up with the anticipated and desired outcome, as the number of actions increases during this month, signifying that the initiatives have proven to be effective.

text: ECSM 2023 CAMPAIGN REPORT

text: Figure 6. Facebook followers increase over time

text: If we examine the growth of followers on the Instagram account, which, as emphasised earlier, was created for the 2023 campaign, we observe that all the increase occurs at the beginning of the cybersecurity month, October. Once again, while the initial annual campaign goals may not have been fully achieved, there has been a noticeable rise in the number of followers with the commencement of the most significant campaign of the year in October.

text: Figure 7. Instagram followers increase over time

text: If we delve into the demographic distribution, considering the age characteristics of the followers, we can draw the conclusion that we are effectively reaching the target audience for this campaign— the general public.

text: Figure 8. Impacted audience sorted by age

text: ECSM 2023 CAMPAIGN REPORT 4.2 ENGAGING MEMBER STATES

text: To measure both the level of engagement and satisfaction of Member States with the ECSM created, designed and produced by ENISA, the following survey was conducted:

text: All respondents organised specific events for the ECSM 2023.

text: Illustration 18. EUSurvey

text: Only 8 of all MS involved in the ECSM 2023 campaign together with the Ministry of Economic Affairs and Climate Policy completed the questionnaire: Croatia, Cyprus,

text: Estonia, Greece, Italy, Poland, Slovenia, Sweden. Therefore, even though the conclusions are not representative of the entire campaign, we will rely on these numbers to extract results

text: All respondents

text: and lessons learned.

text: employed the

text: All of them organised specific events for the ECSM 2023, exceeding the ratio from 2022. content created

text: by ENISA in their

text: The number of human resources allocated for the organisation and launching of the ECSM

text: own ECSM

text: 2023 has ranged between 2 and 6 people, being MS 5 the country that has designated the

text: campaigns.

text: most assets in terms of manpower. The specific departments that somehow participated in the process were Awareness, IT Security and Communications. The number of human resources is much lower than in 2022.

text: Considering that 4 (MS 7, MS 4, MS 6 and MS 8) out of the 9 responding MS did not spend any economic resources in this year’s campaign, the average budget invested in the ECSM activities was approximately 36.100€ (in comparison with the 483.118€ spent in 2022).

text: Sorting the MS from the ones with more expenditures to the ones with less, we find that MS 1 was the country that designated and spent more budget (with 144.378€), in the ECSM 2023 activities, followed by MS 2 (with 96.000€), MS 3 (with 38.320€), MS 5 (with 30.000€) and MS 9 (with 5.000€). If we calculate the average budget contribution considering only the countries which indeed allocated economic resources, the amount rises to 56.700€.

text: The majority of respondent countries, 7 out of 9, used the materials created by ENISA for this 2023 ECSM campaign. Nevertheless, this figure must be taken with caution, as MS 1 and the MS 6 answered in one of the survey’s questions that they did not use ENISA’s content but specified the contrary in other answers. It is fair to conclude that all MS who completed the survey did use in one way or another the content created by ENISA.

text: Of the resources created by ENISA for the ECSM 2023 campaign, the most widely used by MS have been videos and social media posts, which according to the MS who filled the

text: ECSM 2023 CAMPAIGN REPORT

text: survey have been utilised by all countries except MS 5, which has chosen not to use these materials directly but to adapt their content to their own population. On the other hand, albeit to a lesser extent, respondent countries have also made use of the landing page specially created for this purpose, newsletters, paid media, and others, such as printed content, radio and TV media, infographics, etc. Only 2 of the MS have followed the Campaign Management.

text: Illustration 19. Types of materials distributed by MS

text: 8 out of 9 MS

text: Apart from MS 1, all answerers indicated that the ECSM created by ENISA added value to

text: their own national campaigns. Both in the public (stated by all MS except from MS 2, that has indicated that particularly referred to industrial associations) and the private sector (also specified by all ENISA has countries, with the exception of MS 3 and MS 8).

text: successfully added value to

text: Excluding MS 1, all repliers indicated that ENISA successfully managed to share and

text: their national

text: promote innovative and creative content for the ECSM 2023. Obtaining an average evaluation score of 7 out of 10 (slightly higher than the feedback received from the 2022 campaigns and campaign). In general terms, the subjective evaluation of the campaign by the involved MS is has created and better than last year.

text: share innovative and creative content, with ENISA’s work and efforts being evaluated at 7 out of 10. ECSM 2023 CAMPAIGN REPORT

text: Illustration 20. Rates for the campaign given by MS

text: Analysing the Key Performance Indicators (KPIs) gathered to measure the success rate of the ECMS 2023, the following results are extracted:

text: • Only 4 out of 9 MS allocated economic resources to online media. • Comparing the unique visitors to the landing page resulting from the 2023 campaign to the 2022 campaign, the following highlights should be noted - all responding MS achieved an increase in unique visitors. The most significant increase was perceived by MS 2 as all of their visitors were new, given that they did not receive any visitors in 2022. This increase is

text: Both unique

text: followed by MS 3, whose visitors count surged by 89%. MS 4 experienced a 40% increase

text: visitors and the

text: over the 2022 numbers, and MS 7 a 23% raise. Although the metrics for MS 1 and MS 8 are incomplete and cannot be compared to any 2022 figures, they received 14.247 and 1.487 time spent on the unique visitors, respectively. website • Studying the landing page time interaction in October 2023 compared to the same period in increased in all 2022, the following conclusions can be drawn. The only two countries whose metrics can be

text: MS particular

text: compared are MS 3 and MS 8. In both cases, the average time interaction has increased

text: cases compared

text: compared to the numbers obtained in 2022. Visitors spent 35 seconds more on MS 3’s landing page, and 11 seconds more on MS 8’s. Again, we do not have enough information to to the statistics compare the results in the cases of MS 2 and MS 1, but we do know that visitors spent an from the year average of 4 minutes and 29 seconds on the first’s, and 1 minute and 37 seconds on the 2022. second’s. • The most utilised social media channels were Facebook, Instagram and LinkedIn. All of which were employed by 77,78% of the MS that replied to the survey. Even though to a lesser extent, YouTube was also used, this time by 44,44% of the respondents. The social network that was not implemented during the ECSM 2023 was TikTok.

text: Illustration 21. Social media channels employed by MS

text: • Analysing the engagement achieved on social media by the answerers, some notable elements emerge. In all cases with sufficient data for analysis, it is consistently observed that the reach exceeds engagement, which is expected. The countries, ranked from the highest to the lowest engagement, are MS 2 (with 10.008), MS 8 (with 4.852), MS 3 (with 3.904), MS 4 (with 2.384) and MS 7 (with 398). Having only five cases in which the data can be directly compared, one of the lessons learned arises: to minimise variation in the types of collected data and address this matter for

text: ECSM 2023 CAMPAIGN REPORT

text: future campaigns, the process should be homogenised and standardised, collecting the same type of entries for all countries. • With regard to the engagement achieved through the utilisation of YouTube during the ECSM 2023, the following observations are made. Once again, ranking the responding MS from the most views achieved to the least, MS 5 stands out with almost 3 million views, followed by MS 1 with 97.675, MS 2 with 2.218, MS 3 with 1.699, MS 7 with 1 and MS 4 with 0. • Only 4 out of 9 of the responding MS made use of the hashtag Be Smarter Than a Hacker. This outcome was expected, as a debate ensued when it was proposed due to the use it makes of the word “hacker” understood as a cybercriminal. The conclusion of the discussion was for MS who were in favour of using it, to indeed implement it in their publications, and for those who were not in favour, to apply other hashtags such as #ThinkBe4UClick. • Following an initiative created for the ECSM 2023 campaign, a new hashtag was also proposed: #OpenECSM. The Open ECSM was a sub-campaign initiative that encourage individuals to actively participate in the ECSM by sharing their own experiences and insights related to the topic of the 2022 campaign on their personal social media channels, further explained below in the present report. #OpenECSM was employed by 5 out of the 9 respondents.

text: Illustration 22. Hashtags employed by MS

text: ECSM 2023 CAMPAIGN REPORT

text: 5. CONCLUSIONS & RECOMMENDATIONS

text: For the ECSM 2023 campaign, four innovations were introduced and worked on.

text: Firstly, it is the first time that the cybersecurity month is decided to be celebrated throughout the entire year. This idea was born for the purpose of enhancing the reach of cybersecurity awareness, aiming to increase the perceived importance of this knowledge area among users.

text: Secondly, it is the first time that a song was created as the main content of the ECSM campaign. The song as a creative content has been well-received by all MS, leading some of them to even create their own versions.

text: Thirdly, there was an effort to include all the people who work behind the scenes and make it possible for the ECSM campaigns to be carried out and have been running for all these years. This proposal has been called OpenECSM.

text: Lastly, it is the first time that ENISA worked with the social media platform Instagram. Since the ECSM 2023 campaign targeted the general public, it was necessary to also start working with this social media platform.

text: The ideas and creations for the ECSM 2023 were highly welcome by both Member States and the targeted audience. This resulted on a better evaluation of the whole campaign, receiving better feedback than past campaigns, despite the fact that paid social media

text: could not be employed and the campaign only relied on organic posts.

text: Having the aforementioned in mind and analysing ENISA's presence growth on social media, the following points are also noteworthy:

text: • The number of followers increased on all platforms. • Twitter is the platform where ENISA had the highest number of followers. Despite sharing on it the least content, it has generated the most impressions. • The number of reactions on Twitter and Facebook is not significantly different, despite Twitter having a much larger follower count. This indicates that Facebook is the social media platform where ENISA has the most loyal audience.

text: In relation to MS feedback, the following points are also worth highlighting:

text: • All MS that completed the survey have directly used or adapted the deliverables created and produced by ENISA for the ECSM 2023. • Almost 90% of respondent countries have considered ENISA's efforts a success, both in adding value to their own national campaigns and in creating content. • During this campaign, all responding MS have achieved growth in unique visitors and the time these users spend on their websites.

text: As lessons learned, it is clear that the survey format should be reanalysed to further narrow down response options. This would ensure that responses from all MS are more standardised and homogeneous, allowing for better comparisons and more representative conclusions.

text: -X -XX 0 0 -0 -00 -00 XX

text: ABOUT ENISA

text: DOI