Over Confidence In Cyber Security Training Reduces Security

New research by Threat Detection and Response provider, e2e-assure, reveals an alarming disconnect between cyber risk owners and employees within Financial Services, when it comes to cyber security training. 

Despite most (82%) cyber risk owners in this sector being confident employees are engaged in the training they offer, the majority (69%) of workers said they are either only ‘somewhat engaged’ (55%) or ‘not engaged’ (14%) in the training provided by their organisation.

As the sector undergoes digital transformation, and operational efficiencies are increasingly pushed for, staff are experimenting with new tooling to increase their productivity. As a result, most cyber risk owners (76%) are feeling either “very concerned” (25%) or “somewhat concerned” (51%) about the use of AI within their organisation. 
Over one in four cyber risk owners (43%) said their biggest frustration with employees was the use of unauthorised software

The research also found that although most cyber risk owners (80%) are confident in the AI polices they have introduced, there is a clear disconnect between the confidence in these policies and employee understanding. 

  • One in five (20%) of employees stated their company has policies, but admitted they don’t know what they are, and 17% have no idea whether their company has them. 
  • Comparing this year’s findings to e2e-assure’s 2023 research, although 49% of cyber risk owners in Financial Services say resilience is at the top of their agenda this year, up from 34%, speed is now the top priority for the majority (57%).  

This focus on speed over resilience, could suggest that the sector has a closer eye on external threats, jeopardising previous resilience gains if left unchecked.  

  • The research showed that when cyber attacks happen, 43% of Financial Services employees receive a disciplinary and training if they cause a breach, the highest out of all the sectors surveyed. In addition, while 37% have witnessed cyber security incidents happen, only 14% have reported them to IT.
  • But despite cyber risk owners’ confidence in training and AI policies being rolled out, employees revealed the training they are receiving isn’t cutting through, with the vast majority (69%) either only ‘somewhat engaged’ (55%) or ‘not engaged’ (14%) in the training provided by their company.  

In a sector for which speed is of utmost importance, this approach could ironically be slowing companies down, with breaches being framed as individual failures, and employees afraid to report cyber malpractice due to a reactive focus on disciplinaries.   

The data also highlights how cyber risk owners’ confidence in training programmes may be causing them to overlook gaps in the process. The research revealed employees are not receiving the style of training that resonates with them.

Employees in this sector are less likely to receive real-life scenario training (39%), despite a huge majority (82%) of workers stating they would be more engaged if they did. Rob Demain, Founder and CEO at e2e-assure, said: 
“Our research paints a picture of a sector that is overly focused on external threats, rather than fully understanding the risks from within such as employees being unaware of AI policies and therefore using unauthorised software that could jeopardise a company’s security... This sector’s reactive approach to cyber defence and employee training, perhaps understandable in an industry which prioritises speed due to high stakes, is having the unintended consequence of increasing cyber risk...   

“Data attacks such as phishing are becoming more frequent in the Financial Services sector. To ensure future resilience, cyber risk owners must turn their attention to how to mitigate this risk through effective, tailored employee training.” 

The findings show it’s vital for cyber risk owners to start looking at their resilience picture from the ground up, with four key recommendations emerging: 

  1. Tailor training to engage employees 
  2. Create a security awareness culture 
  3. Use automation to reduce human error 
  4. Have the right provider in place 

To read the full report, click HERE:- 

Image: Ideogram

You Might Also Read:

Boards Need To Step Up Or Risk Cybersecurity Fines:


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Turning The Weakest Link Into Cybersecurity’s Strongest Line Of Defence 
Fiber Optic Switches: Powering Secure, High-Speed Networks »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

aizoOn Technology Consulting

aizoOn Technology Consulting

aizoOn is a technology consulting company offering a range of services including IoT & embedded security, mobile security, cybersecurity assessments, risk & compliance, network monitoring and more.

Reed Smith LLP

Reed Smith LLP

Reed Smith LLP is an international law firm with offices in the USA, Europe, Middle East and Asia. Practice areas include Information Technology, Privacy & Data Security.

MSAB

MSAB

MSAB is a pioneer in forensic technology for mobile device examination.

Muninn

Muninn

At Muninn (aka Wehowsky), we specialize in mitigating potential risks within your network, providing one of the leading network detection and response (NDR) solutions on the market.

Digital Guardian

Digital Guardian

Digital Guardian is a next generation data protection platform designed to stop data theft.

Rhebo

Rhebo

Rhebo Industrial Protector monitors and ensures the continuous, correct, and predictable operation of real-time Industrial Control Systems to prevent outages and reduce downtimes.

SmartCyber

SmartCyber

SmartCyber is a company specializing in custom IT projects and Cybersecurity.

Kentik

Kentik

Kentik - one platform for Network Visibility, Performance, and Security.

Authomize

Authomize

Authomize aggregates identities and authorization mechanisms from any applications around your hybrid environment into one unified platform so you can easily and rapidly manage and secure all users.

SECFORCE

SECFORCE

SECFORCE is a leading information security consultancy specialising in bespoke penetration testing and red team engagements.

Allied Telesis

Allied Telesis

Allied Telesis delivers the secure, flexible, and agile solutions needed to meet the expectations of any industry’s critical mission.

South West Cyber Resilience Centre (SWCRC)

South West Cyber Resilience Centre (SWCRC)

The South West Cyber Resilience Centre (SWCRC) is led by serving police officers, as part of a not-for-profit partnership with business and academia.

Arcanna.ai

Arcanna.ai

Using a wide range of out-of-the box integrations, Arcanna.ai continuously learns from existing enterprise cybersecurity experts and scales your team’s capacity to deal with threats.

Recon InfoSec

Recon InfoSec

The Recon InfoSec team includes analysts, architects, engineers, intrusion specialists, penetration testers, and operations experts.

ACL Digital

ACL Digital

ACL Digital, an ALTEN Group company, is a leader in design-led digital experience, innovation, enterprise modernization, and product engineering services converging to Technology, Media & Telecom.

SecAI

SecAI

SecAI is an innovative threat intelligence-driven, and AI-powered vendor aiming at cyber threat detection and response.