What role does employee training play in your cyber risk mitigation plan?

And we’re talking about training people for the cybersecurity basics, we are really talking about culture. Every time someone goes online, or thinks about picking up a USB steak or scanning a QR code, we want them to instinctively go through a mental checklist, a secure practices before doing so. Is the equivalent of doctors always performing a sterilization technique before surgery, or drivers, putting on their seatbelt. The best way to establish a positive security culture is by focusing on behavior, and rewarding people for good behavior: reporting phishing simulations, fast security updates, secure data sharing & storage, etc.. Use your corporate newsletter to applaud individuals and teams for being cyber role models.

1. With Phishing, I have seen environments where +80% of people report attacks to SOC 2. Where employees report the cases consistently in less than 2 minutes. 3. I have seen 78% of people moving to a preferred way of sharing files instead of Consumer cloud sharing. If you do the Behaviour change (awareness) well, it can have a massive impact.

If you take a risk based approach, you can see a measurable improvement in risk posture. The biggest risk now, as it ever was, is social engineering. Establish a phishing training program that focuses on threat reporting. Once phishing simulation reporting rates rise, you can be certain that the risk of date breaches is being measurably reduced. Modern human risk management platforms will also give you insight into risky behaviors while simultaneously triggering reminders to users to correct those behaviors; USB sticks, safe, browsing, secure, information, sharing, etc. By focusing on behavior, you will proactively get ahead of attackers as people will serve as your first responders to an attack.

All the training should be tailored to your context and based on de-weaponized real-life attacks. Users should be given feedback if they spot a real attack; this boosts motivation (is doable with the help of AI). Beyond the user training, using a combination of senior management tabletop trainings combined with Cyber Range services with techie team can lead in to really good insights on both sides of the table so to say.

The threat landscape is evolving so rapidly that we have had to transform the traditional model of security awareness training, and it phishing training. Training content needs to be dynamic with the threat landscape. You can do this very effectively by connecting your training platform to your threat feed. They say that iron sharpens iron, and you could even say that PHISH sharpens PHISH. For instance, we saw a massive surge in QR code fishing at the end of 2023 and drilled ourselves and our ecosystem on the various attacks that our best threat reporters were submitting to the security team. This resulted in thousands and thousands of phishing attacks being removed from the system before other users could even open them.

Only good happens with continuous repetition and renewal of the content. Content that is based on real-life cases that are collected from the defence layer.

It comes down to skills, tools, and confidence. Skills: with enough realistic practice, people will intuitively recognize a threat, and report it to the security team as a matter of habit. Tools: people need a low friction and intuitive process for reporting threats. Make it simple. Make it easy. And make them feel valued for taking the time to use those tools. Confidence: people need confidence in their cyber skills as well as in the security team. People can’t feel afraid of admitting a mistake or suspecting a social engineering attack. The security team must empower people with the skills and confidence to do the right thing and say something when they see something.

The key is to make reporting really easy and straightforward. Making it just a "click" of a continuously trained button. This is, though, not enough if your people do not have strong feelings of psychological safety. Only when people know they will not be judged if they make mistakes, will release their creativity and courage.