The conventional wisdom about security training needs an update — and for reasons that may surprise you.

Cyberattacks are rising in frequency, severity and the damage they cause. Since the weakest link in any networked chain is the user, employee training is a vital part of a comprehensive program that also requires world-class software and savvy policy.

You know all that, but there are other, less obvious reasons to invest in better training that even the most grizzled IT security veteran may not fully appreciate.

Surge of Insider Attacks Suggests Need for Better Security Education

The 2017 IBM X-Force Threat Intelligence Index report showed that a shocking number of incidents come from insiders, employees and other trusted people. Seventy-one percent of attacks against healthcare companies fall into this category, while 58 percent of incidents in financial services, the most-attacked sector, originate from insiders.

The majority of these insiders are inadvertent actors — mostly employees who were tricked into initiating the attacks. These numbers expose the inadequacy of today’s normal training programs. They’re not frequent, memorable or thorough enough. In other words, they’re not working.

The bottom line is that training has not kept up with the evolution of cyberthreats or their remedies. That’s why it’s more important than ever to implement the best possible tools to protect sensitive data. But decision-makers must remember that even the best software cannot stop all threats.

For example, any employee with access to any phone anywhere at any time is potentially vulnerable to social engineering. The reality of bring-your-own-device (BYOD) environments is that employees may be connecting to company resources at all hours and exposing their devices to threats in arbitrary locations and over insecure networks. That’s why great software and solid policies must be accompanied by more frequent and better training.

Five Reasons Why Improved Training Is Vital to Data Security

Of course, training exists to educate employees about threats. Don’t click on that suspicious email link. Don’t insert that thumb drive you found in the parking lot. Don’t keep your password on a note card stuck to your monitor.

But security training should be about far more than just teaching employees to avoid common errors. Below are five surprising reasons why training is vital.

1. Morale

Accelerating threats affect employees most directly by causing unwanted changes in how they work. Security rules implemented without follow-up can feel like an imposed burden. Good training makes employees feel like partners in these policy changes.

2. Speed to Remedy

Better training enables employees to more effectively spot and report suspicious activity. Confusion causes paralysis, but education promotes action. That means faster average resolution times and better institutional learning.

3. Self-Policing

Most threats come from the inside, not the outside. When employees know where threats come from, they’re in a better position help each other avoid unwitting participation in a breach — and to report deliberate participation.

4. Compliance

Rising security threats have ushered in a new era of regulation. That means decisions around security and privacy come with more regulatory and legal ramifications than ever before. It also makes everything more complicated. There’s simply more to learn now, and that demands more and better training. The burden of compliance can also change institutional thinking and lead to a harmful compliance-first mindset. Training helps employees comply with regulations without taking the focus off actual, practical security.

5. Informed Purchase Decision-Making

The most important internal group to train is also the hardest: C-level executives, managers and team leaders. One of the biggest institutional problems around security is the failure to invest in the best solutions. This is often a direct result top decision-makers’ lack of knowledge. Trainings that expose leaders to the risks of today’s increasingly damaging breaches — and the rewards of being ready for them — can be very effective.

It’s Time to Get Creative With Security Training

Cybercrime is being industrialized, automated and optimized using big data analytics and artificial intelligence (AI). Much of that AI is applied to the social engineering of employees. Annual go-through-the-motions training won’t cut it anymore. It’s time to be proactive and get creative.

Don’t think of training as something that happens only at scheduled sessions. It must be constant and continuous. For example, security leaders can create fake malware or phishing attacks. When employees click or open them, serve up a quick training on why they just made a huge error and what to do if this happens again. Security teams might also consider publishing a newsletter or internal podcast to raise security awareness throughout the organization.

As threats evolve and grow more complex and damaging, it’s imperative to rethink how the organization as a whole learns and grows. By educating employees about how cyberthreats affect them, their data and their jobs, IT leaders can make security personal and steer the organizational culture toward security consciousness.

Listen to the podcast series: Take back control of your cybersecurity now

More from CISO

CEO, CIO or CFO: Who Should Your CISO Report To?

As we move deeper into a digitally dependent future, the growing concern of data breaches and other cyber threats has led to the rise of the Chief Information Security Officer (CISO). This position is essential in almost every company that relies on digital information. They are responsible for developing and implementing strategies to harden the organization's defenses against cyberattacks. However, while many organizations don't question the value of a CISO, there should be more debate over who this important role…

Everyone Wants to Build a Cyber Range: Should You?

In the last few years, IBM X-Force has seen an unprecedented increase in requests to build cyber ranges. By cyber ranges, we mean facilities or online spaces that enable team training and exercises of cyberattack responses. Companies understand the need to drill their plans based on real-world conditions and using real tools, attacks and procedures. What’s driving this increased demand? The increase in remote and hybrid work models emerging from the COVID-19 pandemic has elevated the priority to collaborate and…

Why Quantum Computing Capabilities Are Creating Security Vulnerabilities Today

Quantum computing capabilities are already impacting your organization. While data encryption and operational disruption have long troubled Chief Information Security Officers (CISOs), the threat posed by emerging quantum computing capabilities is far more profound and immediate. Indeed, quantum computing poses an existential risk to the classical encryption protocols that enable virtually all digital transactions. Over the next several years, widespread data encryption mechanisms, such as public-key cryptography (PKC), could become vulnerable. Any classically encrypted communication could be wiretapped and is…

6 Roles That Can Easily Transition to a Cybersecurity Team

With the shortage of qualified tech professionals in the cybersecurity industry and increasing demand for trained experts, it can take time to find the right candidate with the necessary skill set. However, while searching for specific technical skill sets, many professionals in other industries may be an excellent fit for transitioning into a cybersecurity team. In fact, considering their unique, specialized skill sets, some roles are a better match than what is traditionally expected of a cybersecurity professional. This article…