Employees: The Champions Of A Strong Cybersecurity Culture

Let’s face it, employees don’t care about security awareness training.

- Jeff Ogden

That’s because most companies are still approaching it in the wrong way. Employees join a company and are thrown into long and boring security training straight away. The training is not very interactive or engaging, it usually includes pages of daunting documentation and often makes use of low budget videos that barely get the message across. And then, once that initial training is done, that’s it. The box is ticked, and employees get on with their new roles.

The point is, that employees must immediately go through large numbers of modules, to achieve “compliance.” And while compliance is obviously important, it needs to be tightly connected to business value, enterprise security, and employees’ personal motivations. But too often, those connections aren’t made.

In many organisations, there’s little follow-up after an employee’s first cybersecurity awareness training. Some employers offer a “refresher” the following year, reminding them of all they’ve forgotten. However, this approach is flawed and inevitably sets the programme up for failure.