October 26, 2023 By Mike Elgan 3 min read

Early to a meeting, an employee decides to check direct messages on their favorite social network.

Uh, oh. A message from the social network’s security team says their account has been hacked. They’ll need to click on the link to reset their password.

You know the rest of the story. The link goes to a fake website from which a malicious payload is downloaded. Once running on the employee’s laptop, it creates havoc on the network.

Despite regular cybersecurity awareness training, employees still compromise security by falling for social engineering attacks. Unfortunately, these attacks compose the vast majority of cyberattacks. And the reason for that is clear: people are vulnerable to being tricked. Human nature is no match for the ever-evolving cyberattack landscape. To make things worse, cyberattackers are increasingly using advanced technologies like synthetic media and artificial intelligence (AI) to accelerate the growing sophistication of social engineering attacks.

Sure, cybersecurity training helps. It can produce real change in the behavior of a majority of employees. But for many staff members, the change is temporary and partial. So here’s what a lot of training often gets wrong, and more importantly, how to get it right.

Why training fails

The essential problem is that cyberattack techniques that exploit human decision-making evolve faster than our thinking about how to effect change in the behavior of employees. It’s time to change faster.

Here are some great ideas about how to make cybersecurity training much more effective:

  1. Personalize. Instead of exposing all staff to the same general curricula, divide employees into smaller groups based on knowledge levels and organizational roles. Develop exercises and training content that resonate with each group, so they can relate to the material and better apply it to their everyday work.
  2. Empathize. Make it clear that people who fall for social engineering attacks aren’t stupid. They’re just not following the right protocols.
  3. Update. Take specific attack examples from the news, and use the latest major attacks in each example. Hypotheticals often fail to resonate — but telling a real example with real outcomes to real businesses that happened recently has a bigger psychological impact.
  4. Entertain. Eyes glaze over with boring training content, and attention shuts down. Make training fun, interesting and colorful. Gamify training, use video-based course material, role-playing, phishing simulation and make it interactive. Use rewards, competitions, leaderboards and other techniques that engage employees.
  5. Multiply. Forget about annual training sessions. You should be revisiting each employee’s cybersecurity training at least quarterly, with the addition of other reminders and exercises tossed in for good measure.
  6. Evaluate. Avoid just holding training sessions and hoping for the best. Make sure you follow up on which parts were effective and which were not, and constantly tweak and improve how you do it.
  7. Streamline. One major reason employees fail to act on their cybersecurity training is that they believe using approved software or accepted techniques gets in the way of productivity. Cybersecurity practices are often seen as a barrier to working efficiently, so employees might break the rules, take shortcuts or use unapproved applications or devices to “route around” the problem of security. So it’s a great idea to understand the situations where this is occurring and figure out how to streamline processes so employees are both productive and secure. In other words, work to improve the ease of use for security-safe practices.
  8. Enculturate. Create a much larger culture of cybersecurity within your organization. Define and communicate a mission that clearly establishes success metrics. Get leadership buy-in, and make sure all executives understand the costs and benefits of better cybersecurity. Partner with, rather than dictate to, employees so they’re part of the solution and not treated like they’re the problem. Clarify and over-communicate.

If employees are the weakest link in the chain of security, then it’s time to strengthen them through much better cybersecurity training practices.

More from Risk Management

Working in the security clearance world: How security clearances impact jobs

2 min read - We recently published an article about the importance of security clearances for roles across various sectors, particularly those associated with national security and defense.But obtaining a clearance is only part of the journey. Maintaining and potentially expanding your clearance over time requires continued diligence and adherence to stringent guidelines.This brief explainer discusses the duration of security clearances, the recurring processes involved in maintaining them and possibilities for expansion, as well as the economic benefits of these credentialed positions.Duration of security…

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today