October 26, 2023 By Mike Elgan 3 min read

Early to a meeting, an employee decides to check direct messages on their favorite social network.

Uh, oh. A message from the social network’s security team says their account has been hacked. They’ll need to click on the link to reset their password.

You know the rest of the story. The link goes to a fake website from which a malicious payload is downloaded. Once running on the employee’s laptop, it creates havoc on the network.

Despite regular cybersecurity awareness training, employees still compromise security by falling for social engineering attacks. Unfortunately, these attacks compose the vast majority of cyberattacks. And the reason for that is clear: people are vulnerable to being tricked. Human nature is no match for the ever-evolving cyberattack landscape. To make things worse, cyberattackers are increasingly using advanced technologies like synthetic media and artificial intelligence (AI) to accelerate the growing sophistication of social engineering attacks.

Sure, cybersecurity training helps. It can produce real change in the behavior of a majority of employees. But for many staff members, the change is temporary and partial. So here’s what a lot of training often gets wrong, and more importantly, how to get it right.

Why training fails

The essential problem is that cyberattack techniques that exploit human decision-making evolve faster than our thinking about how to effect change in the behavior of employees. It’s time to change faster.

Here are some great ideas about how to make cybersecurity training much more effective:

  1. Personalize. Instead of exposing all staff to the same general curricula, divide employees into smaller groups based on knowledge levels and organizational roles. Develop exercises and training content that resonate with each group, so they can relate to the material and better apply it to their everyday work.
  2. Empathize. Make it clear that people who fall for social engineering attacks aren’t stupid. They’re just not following the right protocols.
  3. Update. Take specific attack examples from the news, and use the latest major attacks in each example. Hypotheticals often fail to resonate — but telling a real example with real outcomes to real businesses that happened recently has a bigger psychological impact.
  4. Entertain. Eyes glaze over with boring training content, and attention shuts down. Make training fun, interesting and colorful. Gamify training, use video-based course material, role-playing, phishing simulation and make it interactive. Use rewards, competitions, leaderboards and other techniques that engage employees.
  5. Multiply. Forget about annual training sessions. You should be revisiting each employee’s cybersecurity training at least quarterly, with the addition of other reminders and exercises tossed in for good measure.
  6. Evaluate. Avoid just holding training sessions and hoping for the best. Make sure you follow up on which parts were effective and which were not, and constantly tweak and improve how you do it.
  7. Streamline. One major reason employees fail to act on their cybersecurity training is that they believe using approved software or accepted techniques gets in the way of productivity. Cybersecurity practices are often seen as a barrier to working efficiently, so employees might break the rules, take shortcuts or use unapproved applications or devices to “route around” the problem of security. So it’s a great idea to understand the situations where this is occurring and figure out how to streamline processes so employees are both productive and secure. In other words, work to improve the ease of use for security-safe practices.
  8. Enculturate. Create a much larger culture of cybersecurity within your organization. Define and communicate a mission that clearly establishes success metrics. Get leadership buy-in, and make sure all executives understand the costs and benefits of better cybersecurity. Partner with, rather than dictate to, employees so they’re part of the solution and not treated like they’re the problem. Clarify and over-communicate.

If employees are the weakest link in the chain of security, then it’s time to strengthen them through much better cybersecurity training practices.

More from Risk Management

Back to basics: Better security in the AI era

4 min read - The rise of artificial intelligence (AI), large language models (LLM) and IoT solutions has created a new security landscape. From generative AI tools that can be taught to create malicious code to the exploitation of connected devices as a way for attackers to move laterally across networks, enterprise IT teams find themselves constantly running to catch up. According to the Google Cloud Cybersecurity Forecast 2024 report, companies should anticipate a surge in attacks powered by generative AI tools and LLMs…

Mapping attacks on generative AI to business impact

5 min read - In recent months, we’ve seen government and business leaders put an increased focus on securing AI models. If generative AI is the next big platform to transform the services and functions on which society as a whole depends, ensuring that technology is trusted and secure must be businesses’ top priority. While generative AI adoption is in its nascent stages, we must establish effective strategies to secure it from the onset. The IBM Institute for Business Value found that despite 64%…

Ermac malware: The other side of the code

6 min read - When the Cerberus code was leaked in late 2020, IBM Trusteer researchers projected that a new Cerberus mutation was just a matter of time. Multiple actors used the leaked Cerberus code but without significant changes to the malware. However, the MalwareHunterTeam discovered a new variant of Cerberus — known as Ermac (also known as Hook) — in late September of 2022.To better understand the new version of Cerberus, we can attempt to shed light on the behind-the-scenes operations of the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today