Half Of Employees Don’t Report Security Mistakes

Despite the increased adoption of security awareness training, new research reveals that more than half of cyber security professionals share concerns over security behaviours. 

Respondents to a recent ThinkCyber Security survey, which revealed the attitudes towards security awareness training, were asked what security behaviours caused the most concern at their organisation.

The study also showed that a quarter of cybersecurity professionals doubt their colleagues do change their behaviour with current security awareness training, 

Furthermore, 60% of respondents admitted they only get training once every few months or even just once a year.

The top results for risky behaviour were:

  • Clicking on links in emails (53%)
  • Sharing corporate data outside of the business (53%)
  • Sharing of usernames and passwords (51%)

As threats grow more sophisticated and frequent, it’s essential to provide regular and consistent training to stay effective. If training doesn’t keep up with the latest threats, organisations will be left vulnerable and stuck in the past.

According to Tim Ward, CEO at ThinkCyber "Security awareness training is most effectively delivered in the moment when it can be directly contextualised by the recipient. This approach not only enhances comprehension by linking awareness to an immediate and relevant situation but also serves as a proactive nudge towards safe behaviour.”  

“By intervening at the precise moment when a risky action is about to be taken, individuals are more likely to understand the specific dangers and consequences associated with their actions. This timely intervention ensures that the lesson is not abstract or theoretical but grounded in a real-world context, making it more impactful...

“Therefore, the individual is informed about potential risks and guided towards making safer choices before any harm can occur, significantly mitigating the chances of a security breach or incident."

Organisations must also measure and track the progress of their security awareness programmes to determine effectiveness and make changes where necessary. When respondents were asked whether the business had a way to identify the user groups who are carrying out these behaviours, almost half (49%) said that they did not for all behaviours causing concern.

Other Findings from the Survey Included:

  • 42% of respondents felt that their organisation could not even somewhat prove whether their current security awareness training is changing risky behaviours. For those who felt that their business could somewhat prove a change in risky behaviours. Further research would be required to determine if this comes in the form of phishing test click rates which can be highly variable.
  • Half of respondents said that they would not feel free from repercussions if they reported a mistake within their organisation.
  • When asked whether they felt like security awareness training is a priority shared across the business, 51% said they thought most people across the business were focused on security, whereas 39% said they felt only the executives and security teams were focused on it.

When so many security experts thinks that their organisation's security awareness training isn't cutting it, it’s a clear indication that it’s time to re-evaluate.

“Cyber security should be a concern for everyone, so pinpointing which user groups need extra help with safe practices is crucial for any business... A training programme that’s flexible and enjoyable can make all the difference, boosting staff engagement and giving cyber professionals greater confidence in their team’s ability to make smart security decisions.” Ward says.

Top 3 ways to make Security Awareness Training work:  

  • Deliver ongoing training– Annual training isn’t enough. Security awareness training should be provided to employees on a regular basis. This will help to maintain awareness, keep employees up to date with the latest cybersecurity threats.
  • Drip-feed content – When respondents were asked how they like to receive security awareness training, 70% said they want to keep their knowledge fresh, and that little and often works for them. Delivering the content of your security awareness programme in small, bite-size segments, not only helps to maximise engagement level amongst staff but also helps to reinforce ongoing awareness and learning outcomes. 
  • Measure engagement levels and progress – Measure behavioural impact as well as engagement - measuring engagement levels offers a leading indicator of progress, but behavioural impact shows the effectiveness of the programme in reducing risk as well as highlighting user groups that display risky behaviour.

Think Cyber    |   Think Cyber

Image: Mike Hindle

You Might Also Read: 

Protecting Data In The Remote Working Era:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Chinese Hackers Exploit Cisco Vulnerability To Deliver Malware
Breach Exposes Millions Of Mobile Numbers To Phishing Attacks »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Protective Intelligence

Protective Intelligence

Protective Intelligence brings together a group of information security specialists with a passion for delivering high-quality solutions.

Bayshore Networks

Bayshore Networks

Bayshore Networks was founded to safely and securely protect Industrial IoT (IIoT) networks, applications, machines and workers from cyber threats.

Beachhead Solutions

Beachhead Solutions

Beachhead's SimplySecure is a configurable, web-based management tool allowing you to remotely secure vulnerable mobile devices in your organization.

Lynx Software Technologies

Lynx Software Technologies

Lynx provide secure software and operating systems for use in mission critical applications such as aerospace, medical, transportation and IoT.

Ubisecure

Ubisecure

Ubisecure provide Identity & Access Management solutions.

ACI Worldwide

ACI Worldwide

ACI Worldwide powers electronic payments for more than 5,000 organizations around the world.

Blackwall

Blackwall

Blackwall (formerly BotGuard) is a security infrastructure company focused on protecting web ecosystems from automated threats, while optimizing performance for hosting environments.

36 Group

36 Group

36 Group's criminal law team, has the experience and specialist knowledge to conduct effectively trials heavily concerned with the growing phenomenon of Cybercrime.

CleanCloud by SEK

CleanCloud by SEK

CleanCloud by SEK is a CSPM product focused on public cloud data protection and security regulations, with over 400 compliance checks for the market's leading frameworks and regulations.

Bleckwen

Bleckwen

Bleckwen is a proven fraud detection system that helps financial institutions build trust with customers.

Gigit

Gigit

Gigit’s Service portfolio focuses on your business’ needs and the integration of comprehensive cybersecurity policies, plans, procedures, and practices into your business culture and operations.

Kontron

Kontron

Kontron offers a combined portfolio of secure hardware, middleware and services for Internet of Things (IoT) and Industry 4.0 applications.

Green Radar

Green Radar

Green Radar is a next generation cybersecurity company which combines technologies and services together to deliver Threat Detection for Emails and Deep Threat Analytics and Response.

CloudCoCo

CloudCoCo

CloudCoCo help UK businesses of all sizes and industries succeed by providing enterprise-grade technology at small-business prices.

Airlock Digital

Airlock Digital

Airlock Digital was created after many years of experience in implementing whitelisting/ allowlisting solutions in Federal Government and various enterprises in Australia.

Mitra Informatics Integration (MII)

Mitra Informatics Integration (MII)

Mitra Informatics Integration is the information communication technology solution business of the Metrodata Group.