已完成 / Completed: 0 / 250%

網路安全認知問卷

Cybersecurity Awareness Questionnaire

本問卷旨在了解您對 COFFSec 與進攻性安全的看法與認知。您的回答將有助於我們更好地掌握業界趨勢。感謝您的參與！
This questionnaire aims to understand your views on COFFSec and offensive security. Your responses help us better understand industry trends. Thank you!

預計完成時間 / Estimated time: 3–8 分鐘 / min

您目前從事的行業是？

What industry do you currently work in?

資訊科技 / 互聯網IT / Internet

金融 / 銀行Finance / Banking

政府 / 公共部門Government / Public Sector

教育 / 學術Education / Academia

醫療 / 健康Healthcare

其他Other

您在網路安全領域的經驗年限是？

How many years of experience do you have in cybersecurity?

無經驗No experience

1–2 年1–2 years

3–5 年3–5 years

5–10 年5–10 years

10 年以上10+ years

您認為目前最大的網路安全威脅是什麼？（可多選）

What do you think are the biggest cybersecurity threats today? (Multiple choice)

勒索軟體Ransomware

網路釣魚攻擊Phishing attacks

進階持續性威脅（APT）Advanced Persistent Threats (APT)

內部威脅Insider threats

供應鏈攻擊Supply chain attacks

AI 驅動的攻擊AI-driven attacks

零時差漏洞（Zero-day）Zero-day exploits

您對「進攻性安全」（Offensive Security）的了解程度如何？

How familiar are you with Offensive Security?

完全不了解Not familiar at all

聽說過但不深入了解Heard of it but not in-depth

有一定了解Moderately familiar

非常了解並有實作經驗Very familiar with hands-on experience

您認為進攻性安全對企業防禦有多重要？

How important do you think offensive security is for enterprise defense?

至關重要Critical

比較重要Important

有一定作用Somewhat useful

不太重要Not very important

您的組織是否定期進行滲透測試？

Does your organization conduct regular penetration testing?

是，定期進行Yes, regularly

偶爾進行Occasionally

尚未，但計畫中Not yet, but planning to

沒有No

您認為紅隊演練（Red Teaming）對安全評估的價值如何？

How valuable do you find Red Teaming for security assessments?

非常有價值Very valuable

有一定價值Somewhat valuable

價值有限Limited value

不確定Not sure

您最關注的安全領域有哪些？（可多選）

Which security areas concern you most? (Multiple choice)

Web 應用程式安全Web Application Security

雲端安全Cloud Security

物聯網安全IoT Security

行動裝置安全Mobile Security

網路基礎設施安全Network Security

端點安全Endpoint Security

身分與存取管理（IAM）Identity & Access Management

AI / 機器學習安全AI / ML Security

您是否參與過漏洞獎勵計畫（Bug Bounty）？

Have you ever participated in a Bug Bounty program?

是，正在積極參與Yes, actively participating

曾經參與過Have participated in the past

沒有，但有興趣No, but interested

沒有，也不感興趣No, and not interested

Q10

您認為 AI 技術對網路安全的影響是？

What impact do you think AI has on cybersecurity?

主要是正面的（增強防禦能力）Mostly positive (enhanced defense)

主要是負面的（增加攻擊手段）Mostly negative (more attack vectors)

雙面刃，需要平衡Double-edged sword, requires balance

不確定Not sure

Q11

您的組織每年在網路安全上的預算投入大約是多少？

What is your organization's annual cybersecurity budget?

較少（< 50 萬港幣）Low (< HK$500K)

適中（50–200 萬港幣）Medium (HK$500K–2M)

較高（200–500 萬港幣）High (HK$2M–5M)

非常高（> 500 萬港幣）Very high (> HK$5M)

不清楚Don't know

Q12

您認為資安意識培訓的效果如何？

How effective do you think security awareness training is?

非常有效Very effective

有一定效果Somewhat effective

效果有限Limited effectiveness

幾乎沒用Almost useless

Q13

您目前持有哪些網路安全相關認證？（可多選）

Which cybersecurity certifications do you currently hold? (Multiple choice)

OSCPOSCP

OSEPOSEP

CISSPCISSP

CEHCEH

cismcism

GPEN / GWAPTGPEN / GWAPT

其他認證Other certifications

目前無認證No certifications

Q14

您通常透過哪些管道獲取網路安全資訊？（可多選）

How do you usually get cybersecurity news & knowledge? (Multiple choice)

社群媒體（Twitter/X、LinkedIn 等）Social media (Twitter/X, LinkedIn, etc.)

資安部落格 / 論壇Security blogs / forums

資安會議 / 大會（如 DEF CON、Black Hat）Security conferences (e.g. DEF CON, Black Hat)

資安廠商報告Vendor reports

播客 / YouTubePodcasts / YouTube

線上訓練平台（如 HTB、TryHackMe）Online training platforms (e.g. HTB, TryHackMe)

電子報 / 新聞訂閱Newsletters / news subscriptions

Q15

您認為零時差漏洞（Zero-day）的披露應如何處理？

How should zero-day vulnerability disclosure be handled?

負責任的披露（通知廠商後再公開）Responsible disclosure (notify vendor first)

完全公開（立即向公眾公開）Full disclosure (immediate public release)

僅限私下報告給廠商Private reporting to vendor only

視情況而定It depends on the situation

Q16

您對 CTF（Capture The Flag）競賽的參與情況如何？

What is your involvement with CTF competitions?

經常參加Actively participating

偶爾參加Occasionally

有興趣但尚未參加Interested but haven't participated

不感興趣Not interested

Q17

您認為網路安全行業最需要解決的問題有哪些？（可多選）

What are the most pressing issues in the cybersecurity industry? (Multiple choice)

人才短缺Talent shortage

工具與技術過於複雜Tool and technology complexity

預算不足Insufficient budget

資安意識薄弱Lack of security awareness

法規合規壓力Regulatory compliance pressure

AI 帶來的新型風險New risks from AI

Q18

您是否了解或使用過 COFFSec 的服務或產品？

Are you familiar with or have you used COFFSec's services or products?

是，正在使用Yes, currently using

曾經使用過Have used in the past

聽說過但未使用Heard of but haven't used

不了解Not familiar

Q19

您未來最想深入學習或研究的安全領域有哪些？（可多選）

Which security areas would you like to learn or explore more in the future? (Multiple choice)

滲透測試Penetration testing

逆向工程Reverse engineering

惡意軟體分析Malware analysis

雲端安全Cloud security

事件應變Incident response

DevSecOpsDevSecOps

AI 安全AI Security

硬體 / 韌體安全Hardware / Firmware security

Q20

在您的組織中，進攻性安全（紅隊、滲透測試）與防禦性安全（SIEM、EDR 等）的資源投入比例大約為何？

In your organization, what is the approximate resource split between offensive security (red teaming, pentesting) and defensive security (SIEM, EDR, etc.)?

進攻重於防禦（>60% 進攻）Offense-heavy (>60% offense)

略偏進攻（40–60%）Slightly offense (40–60%)

大致平衡（約 50/50）Roughly balanced (~50/50)

略偏防禦（40–60%）Slightly defense (40–60%)

防禦重於進攻（>60% 防禦）Defense-heavy (>60% defense)

幾乎只投入防禦Almost entirely defensive

Q21

在委外進攻性安全服務時，您最重視供應商的哪些特質？（可多選）

When outsourcing offensive security services, which qualities matter most in a provider? (Multiple choice)

團隊認證（OSCP、OSEP 等）Team certifications (OSCP, OSEP, etc.)

過往實戰成果與案例Proven track record & case studies

測試方法論的嚴謹度Rigor of testing methodology

報告透明且可執行Transparent, actionable reporting

熟悉本地法規與環境（香港/亞太）Familiarity with local regulations (HK/APAC)

價格合理 / CP 值高Reasonable pricing / value

回應速度與彈性Responsiveness & flexibility

改善後續支援與覆測Post-engagement support & retesting

Q22

您認為 AI 在進攻性安全中最可能帶來突破的應用是什麼？

Where do you think AI will drive the biggest breakthrough in offensive security?

自動化偵察與攻擊面發現Automated recon & attack-surface discovery

漏洞利用自動生成Automated exploit generation

進階社交工程與釣魚Advanced social engineering & phishing

即時繞過防禦機制Real-time defense evasion

自主型攻擊 AgentAutonomous offensive agents

仍持懷疑態度Still skeptical of AI in offense

Q23

導入進攻性安全實踐時，您組織面臨的最大阻力是什麼？

What is the biggest barrier to adopting offensive security practices in your organization?

預算限制Budget constraints

缺乏合適人才Lack of skilled talent

管理層對風險/中斷的顧慮Leadership fear of risk/downtime

法規與合規限制Regulatory & compliance constraints

對其價值認知不足Low awareness of its value

缺乏合用工具與流程Lack of suitable tools & processes

Q24

若 COFFSec 能協助您打造一套攻防策略，您最希望優先解決的痛點是什麼？

選填 / Optional

If COFFSec could help build an offensive/defensive strategy for you, which pain point would you most want addressed first?

Q25

您對網路安全行業及 COFFSec 有什麼建議或想法？

選填 / Optional

Any suggestions or thoughts about the cybersecurity industry and COFFSec?

您已回答 0/25 題 · 0 of 25 answered