Cyber awareness must change behaviour

Why the future of cyber security starts with people

The challenge is not awareness.
The challenge is behaviour.

Training completion is not preparedness

For years, organisations have invested in annual cyber security training, mandatory quizzes and phishing simulations. Leaders track participation and campaign results, but completion alone does not show whether employees will make safer decisions when faced with a genuine threat.

Most employees know the basics. They understand that suspicious links should be treated with caution, passwords should be protected and unusual requests should be questioned. The difficulty is applying that knowledge while dealing with deadlines, interruptions and competing priorities.

In practice, the problem is rarely that employees have never heard of phishing or password security. The challenge is recognising risk when a request appears credible, urgent and consistent with their day-to-day responsibilities.

Many traditional awareness programs are designed to deliver information and demonstrate compliance. They often rely on generic content that bears little resemblance to the situations employees encounter at work. Effective awareness should prepare people to recognise and respond to risk in real situations.

Design for how people work

Employees make decisions while moving between emails, meetings, applications and messages. They may be managing customer expectations, processing urgent requests or responding to senior colleagues.
Attackers take advantage of these working conditions. Fraudulent messages are deliberately designed to appear familiar or time-sensitive, encouraging someone to act before checking whether the request is legitimate.

This does not mean people are careless or inherently weak. It means their decisions are influenced by the circumstances in which they work.

Awareness programs should account for these pressures. Scenarios need to reflect actual working environments and provide employees with practical ways to pause, verify a request and report a concern without unnecessarily slowing down routine work.

Measure what matters

Completion rates show who attended training. They provide limited insight into how someone will respond to a convincing phishing email, an unexpected payment request or an impersonation attempt.
A more useful approach is to focus on the behaviours that have the greatest influence on risk. This includes whether employees:

• Recognise the warning signs of a suspicious request
• Verify unusual instructions through an appropriate channel
• Escalate concerns through the correct process
• Report mistakes early enough for the organisation to respond.

The aim is not to turn every employee into a cyber security specialist, but to help people apply what they know, particularly when they are under pressure.

Make training relevant

Employees do not all face the same risks.

A finance employee processing payments encounters different threats from an executive handling sensitive information. Developers, customer service representatives and operational personnel each work with different systems, data and third parties.

Awareness activities should reflect the employee’s responsibilities, level of access and exposure to relevant threats. A payment fraud scenario may be useful for finance teams, while developers may need greater focus on credentials, source code and software supply chains.

When employees see themselves in the examples presented, they pay attention. When training feels generic, they tune out.