Behaviour surveys are in beta. What you see today is an early version with a small set of behaviours and limited customisation. We're building it in the open with customers, so what's described in this article will change. See What's coming next for where it's heading and how to shape it.
Behaviour surveys help you understand why a security behaviour happens. When someone triggers a behaviour event, such as clicking a simulated phishing link without reporting it, CybSafe asks them a short question about what got in the way. Their answers are mapped to COM-B (capability, opportunity and motivation) and turned into an insight with suggested next steps.
Before you start
Behaviour surveys are part of RESPOND and run as workflows in the background.
To send surveys in Microsoft Teams or Slack, set up the integration first. The Web channel sends an email with a link to the survey.
Answers are classified with AI. Your account needs AI features turned on. If they're off, answers are saved but no insight is produced. Contact your customer success manager to check.
Create a behaviour survey
Go to RESPOND > Behaviour surveys and click Create.
On Configuration, choose the Security behaviour and the Trigger event that should send the survey.
Choose a Survey type: Single Select, Multi Select or Text. The questions are written by CybSafe's behavioural scientists for that behaviour and trigger.
Set a Send delay if you want to wait before the survey goes out. Leave it empty to send straight after the event.
Set a Re-entry delay. This is the minimum time before the same person can get this survey again. The minimum is 7 days. See How send and re-entry delays work for how to choose a value.
Choose your Delivery channels: Web, Microsoft Teams or Slack.
Check the Name. It's filled in for you from the behaviour, and you can change it.
Click Next. On Audience, add filters if you only want to survey some people. Leave it empty to survey everyone who triggers the event.
Click Next. On Review, click Preview to see the survey as your people will.
Click Activate to start the survey, or Save draft to activate it later.
How send and re-entry delays work
A behaviour survey isn't sent to a list of people on a date. It's a workflow that watches for the trigger event and sends the survey to each person as they trigger it. That's why there are two delays, and why there's no start date or schedule.
Send delay is the gap between someone triggering the event and receiving the survey. Leave it empty to ask straight away, while the moment is fresh. Add a delay if you'd rather give people a little distance from the event first.
Re-entry delay is a cooling-off period for each person. Because the workflow fires every time the event happens, someone who triggers it three times in a week would otherwise be asked three times. The re-entry delay stops that: once a person has received the survey, they won't get it again until the delay has passed and they trigger the event again.
Choosing a value:
7 days (the minimum) suits behaviours you expect to see often and want to keep learning about as circumstances change.
60 to 90 days is a sensible default. People get asked at most once a quarter, and you still pick up changes over time.
A long delay, such as 365 days, means each person is effectively asked once. Use this when you want a one-off read on a behaviour rather than an ongoing one.
You can change both delays after the survey is live from the three-dot menu, so you can start conservative and shorten the re-entry delay later if responses are thin.
Which behaviours can I survey?
You can currently survey these security behaviours:
Clicks only a legitimate link
Reports a suspicious message
Shares sensitive information only with an approved recipient
This list is deliberately short while we learn which behaviours customers most want to understand. Adding more is our top priority for the beta; see What's coming next.
What your people see
Your people get a short message explaining what happened and asking for their view. They click Start, answer up to two questions and click Submit.
See the results
Click a survey's name on the Behaviour surveys page to open its report.
Insight shows a short summary of what the answers mean, up to three suggested next steps, a COM-B breakdown, responses over time and a breakdown by group. Click any percentage in the summary to see the responses behind it.
Responses shows how many surveys were sent, how many people responded, the leading COM-B driver and every answer with its COM-B classification. Use the filters to narrow by date, group, question type or COM-B category.
The insight appears once at least 10 responses have been classified. Until then, the Insight page says Collecting data. Analysis runs once a day. To run it sooner, click the three dots next to the survey and choose Analyse.
Suggested next steps
Each suggestion targets the COM-B driver behind a finding and names who it's for. A suggestion might be a nudge from the library, a training module or an action outside CybSafe, such as changing a default setting. If CybSafe Signal is enabled, you may also see suggestions to generate a new nudge or module. Suggestions don't change anything on their own: set up the ones you want in the usual way.
Manage your surveys
Click the three dots next to a survey to:
Pause or Activate it
Edit its name, send delay, re-entry delay or audience
Analyse its responses now
Archive it, or Unarchive it from the Archived view
You can't change the behaviour, trigger, survey type or channels after you create a survey. Create a new survey instead.
What's coming next
Behaviour surveys started with a question: when someone does something risky, can we find out why, at scale, without a long questionnaire? The beta answers that for a handful of behaviours. The aim is to make "why did this happen?" a question you can ask about any behaviour CybSafe tracks, and to turn the answers into the right nudge, module or policy change.
Here's what we know is missing today and what we're looking at, roughly in priority order:
More behaviours. The three supported behaviours are a starting point. Extending survey questions to more of the behaviours in CybSafe's behaviour library is the biggest gap, and the first thing we're working through with our Science and Research team.
Scheduling and time zones. Surveys go out as events happen, with a fixed send delay that doesn't account for where the recipient is. We're exploring the ability to set a survey up in advance to start on a date, and to deliver within working hours in each person's time zone.
Surveying a chosen group or list. Today a survey reaches people who trigger the event, filtered by audience. We're looking at letting you survey a specific group directly, or upload a list of people, without waiting for an event.
Customisation. The questions are written by CybSafe's behavioural scientists so that answers map cleanly to COM-B and insights are comparable across customers. We've heard requests to edit question wording and the message that introduces the survey. We want to understand which parts matter most before deciding what to open up, so tell us.
None of this is committed to a date yet. What gets built first depends on what we hear during the beta, so if one of these would unblock you, or something else is missing, tell your customer success manager. Specific examples of the behaviour you want to survey and the question you'd want to ask are the most useful feedback we can get.
FAQs
Why is my Insight page empty? The survey needs at least 10 classified responses before an insight appears, and the analysis runs once a day. Check the survey is active and that AI features are turned on for your account.
Is the summary written by AI? CybSafe calculates every statistic first. AI then writes the summary from those statistics, and every number in it links to the responses behind it. Your people's answers are classified by AI; the summary itself is written only from aggregate figures.
Can someone get the same survey twice? Only after the re-entry delay has passed and they trigger the event again. See How send and re-entry delays work.
Can I schedule a survey to start later? Not yet. A survey starts watching for events as soon as you activate it. If you want to prepare one now and run it later, click Save draft and activate it when you're ready.
Why can't I edit the questions? The questions are designed by CybSafe's behavioural scientists so that answers can be reliably classified against COM-B. We're gathering feedback on what customisation would be most valuable during the beta.