Cybersecurity Training Isn’t The Complete Solution

Cyber security training firms continue to stress the importance of educating employees in order to minimise the risk of cyber threats.

‘Staff’, they argue, ‘are both your company’s greatest asset and your biggest potential security risk’. And as employees are the weakest link in the security chain, they must be well trained and educated.  
 
It is true that employees are a huge security weakness: 46% of IT security incidents are caused by employees each year globally and 55% of companies surveyed by Experian Data Breach Resolution said they ‘experienced one or more security incidents where the catalysing event was a negligent or malicious employee’. 

Educating employees, however, is not necessarily the complete answer. As cyber security threats continue to evolve and grow at an increasing pace, employees and training are no longer able to keep up.  

Even Bruce Schneier, the very cyber security expert that popularised the Golden Triangle concept of ‘people, process and technology’, now plays down the importance of education in cyber security in comparison with technology and automation. He now states that ‘People and process work on human timescales, not computer timescales’.
   
To keep up with the pace of cyber threats we should ditch the emphasis on people and process, which are far too slow, and focus on the power of technology.

The only way to manage a technological threat that is growing faster than humans can react to it, is to look to technology itself for solutions.  

Thus for the below reasons, employee education is no longer the way CIOs and other executives should go to in order to keep their companies safe:

1. Cyber threats are evolving too rapidly for mass education of employees to be successful    

With each passing year the technology of cyber-attacks evolves and the speed of this evolution seems to continue accelerating. In the last 12 years alone there have been a 10,000 fold, increase, in the number of new digital threats.  

The hacking profession has moved from annoying viruses and spam created by hackers to show off their computing muscle and gain two minutes of cyber fame, to sophisticated organised hacking networks which gain serious money from cyber-crime.

As Symantec’s 2017 security report summarised, ‘New sophistication and innovation’ have meant ‘seismic shifts in the focus of attacks’. The sophistication of hacking has now evolved to the degree that even the strongest nation states and corporations are fair prey for hackers.  

This timeline demonstrates exactly how these attacks have matured over time and now pose serious financial and reputational consequences to businesses. What started off as basic viruses and worms are now highly sophisticated key and certificate-based attacks which can prise open even the most advanced security systems. 

More worryingly, as businesses, governments and individuals continue to connect more and more things to the Internet, the opportunities for attackers grow ever greater. Eventually, as the internet of things (IoT) hooks up more or less everything to the Internet, so too will more or less everything be fair game for hackers. 

What’s more, cyber security experts only expect the frequency of these attacks to continue to grow. In 2016, Symantec identified some 100 new malware families in 2016 - more than triple the year before.  

Cyber criminals are also suspected to already be manipulating developing technologies such as data on trading platforms where new financial instruments - such as cryptocurrencies - are traded.
 
Including digital infrastructure and cryptocurrencies along with the IoT, there are now three new, rapidly growing sectors that could be vulnerable to hacking.

And while hackers are already working on compromising these areas, most employees are unlikely to even understand the basic concepts of these developing technologies, let alone know how to use them responsibly, demonstrating the true severity of the task of educating employees on cyber security.

2. The cyber security problem is too broad for employees to be provided a complete education  

We have now connected all but every aspect of our lives to the internet meaning the security threat is broader than ever. Business structures and operations have also become more complex, leaving more areas vulnerable to cyber threats. Educating employees on all these areas is very much unfeasible.    

When cyber security training meant teaching employees to change their password regularly and not to open suspicious attachments, the case of educating on cyber security was far simpler.  

Now, however, cyber security training means having to educate employees on how to create passwords; manage file storage and exchange; know which websites and emails are safe; how to download files; which products you should use; how to avoid social engineering and phishing attacks, etc., just to name a few.

As Deloitte summarises in a 2016 risk report, the cyber security concern is not just frequency, but ‘The fact that today’s cyber security efforts require guarding against a broader range of challenges.’ These challenges include ‘new and emerging technologies, trends in mobile usage, social media, well-funded and organised foes, round-the-clock attacks, and more’.

   
And as employees do after all have their own jobs to do, they cannot be expected to somehow keep track of all these threats. The challenge with educating employees is to somehow make them aware of the risk their online activities pose and how to manage it, without rendering them unproductive by overly complex procedures. 

But this balance is looking increasingly difficult to achieve as the breadth of security threats continues to expand.  

More likely, employees will continue to be compromised and continue to cover up these compromises rather than resolve them as has been shown to be the case in the majority of businesses.

3. Modern technologies such as machine learning and big data security are now more efficient and effective solutions for a CIO than educating employees 

So, if hackers will always be one step ahead of employees, what solutions can we use to prevent cyber security breaches?  

One answer is machine learning solutions which are capable of monitoring user and application behaviour. These solutions, such as Cylance Cybersecurity, are very effective in recognising malware. Utilising these alternatives means you are able to predict and prevent threats rather than working reactively on the back-foot, as is the case with anti-virus software.
 
Blockchain is another example of a cutting edge technology that can significantly minimise cyber security risks. It does so by addressing the two key security principles: process and trust.  Blockchain solves the issue of process by implementing smart contracts that can enforce procedures within the company. For example, say, ‘user A can only access X document with approval from user B and C’.
 
In respect to trust, it allows companies to ensure that procedures are being executed in compliance with regulation. In the above example, there is no human verification that could result in security lapses. Instead, the blockchain system approves or denies access based on set criteria, reducing the risk of human error which so often results in security breaches.

So when choosing a security vendor, opt for one that uses the latest technologies that can help reduce the risk of human error.

It is simply no longer possible for your employees to be educated on the latest cyber security threats as they constantly grow and evolve.

Instead, the most effective way to fight the latest technological threats is deploying the latest technological defence systems in your own favour.

ITProPortal

You Might Also Read: 

Blockchain’s Brilliant Approach To Cyber Security:

Will GDPR Protect Privacy Or Just Lead To More Hacks?:

Strategies For A Cyber Security Culture (£):

 

« Tech Giants Face US Congress Over Russia Election
Garry Kasparov On AI & Cybersecurity »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Mobile Guroo

Mobile Guroo

Mobile Guroo is a strategy and systems integrator for Enterprise Mobility Management projects.

Cyber Security & Information Systems Information Analysis Center (CSIAC)

Cyber Security & Information Systems Information Analysis Center (CSIAC)

CSIAC is chartered to leverage best practices and expertise from government, industry, and academia on cyber security and information technology.

Referentia

Referentia

Referentia leads the development of critical infrastructure solutions that benefit society, including cyber security and network performance management.

Oneconsult

Oneconsult

Oneconsult provides cyber security services focusing on penetration tests / ethical hacking, ISO 27001 security audits and incident response & IT forensics.

Omada

Omada

Omada is a leading provider of IT security solutions and services for identity management and access governance.

AAROH

AAROH

AAROH helps customers in Government, Law Enforcement, and Enterprises to identify, prevent, detect, resolve and protect from threats, crimes, breaches & fraud.

SwiftSafe

SwiftSafe

SwiftSafe is a cybersecurity consulting company providing auditing, pentesting, compliance and managed security services.

Seavus Accelerator

Seavus Accelerator

Seavus Accelerator's goal is to create an enabling and stimulating environment for start-ups growth and provide continuous high quality acceleration and investment support.

ITsMine

ITsMine

ITsMine’s Beyond DLP solution is a leading Data Loss Prevention solution used by organizations to protect against internal and external threats automatically.

NightDragon

NightDragon

NightDragon is a venture capital firm investing in innovative growth and late stage companies within the cybersecurity, safety, security, and privacy industry.

Redsquid

Redsquid

At Redsquid we are all about making a difference to our customers with the use of technology, as an innovative provider of solutions within IoT, Cyber security, ICT, Data Connectivity & Voice.

Kingston Technology

Kingston Technology

Kingston is a leading global manufacturer of memory and storage solutions including encrypted storage solutions to protect data inside and outside the firewall.

BIRD Cyber

BIRD Cyber

BIRD Cyber is a program to promote collaboration on cybersecurity and emerging technologies aimed at enhancing the cyber resilience of critical infrastructure.

Central Intelligence Agency (CIA)

Central Intelligence Agency (CIA)

The CIA is an independent agency responsible for providing national security intelligence to senior US policymakers. This includes cyber security related activities.

Hook Security

Hook Security

Setting a new standard in security awareness. Hook Security is a people-first company that uses psychological security training to help companies create security-aware culture.

Astreya

Astreya

Astreya is the leading IT solutions provider for some of the world's most recognizable and innovative organizations.