How can you measure the effectiveness of your security awareness training program?

A security culture pulse survey is a MUST to establish a baseline. Using phishing emails to do a pre-training assessment is going back to old-school process where without even providing education, students were tested out, ranked and rated to gauge their level of understanding. This might work for older audiences, as they may "accept" older processes and accept status-quo, but with Gen-Z, and millennials it's an absolute no-no. Moreover, security leaders may be afraid to do a pulse survey, as they feel if the assessment results are not favorable, senior management might hold them responsible. This thought process has to be avoided. A good security culture pulse survey should be conducted in a non-technical and fun way.

Completion rates are just for compliance. Organizations should go beyond completion rates and move towards engagement rates & coverage. Moreover, the content should lend itself to employee review and comments. Finally, a Human Risk Score should be developed over a period of time, that will provide a true view of what the maturity level of an organization is, when it comes to cyber security culture.

Focus on developing intellect, and not obsess over completion rates. Quizzes are a great way to engage and perform knowledge checks. Include real world cybercrime in your quizzes and check if employees are aware of the impact that these crimes have created. These knowledge checks should be a part of employee awareness continuous learning program.

The sole purpose of behavior analysis should be to improve the intellect, build mindfulness & promote security culture. Remember, a person goes through different emotions during the day, and is not constantly experiencing one emotion. Cybercriminals use these emotions for social engineering and phishing. Making people understand themselves & their emotional vulnerabilities better is an uphill task, and changes don't happen overnight. While you can monitor technology as much as you can for behavior analysis, it will never be 100% accurate. Most insider threats catch the organizations unaware, and at the end the question remains "this person was always so nice, can't believe he or she has done this"

People are the soul of any organization. Security Awareness trainings are at the highest disadvantage if feedback is not being collected. A regular employee is not bothered about cybersecurity, as they are focused on their day job. To make them be bothered, you have to make trainings entertaining. You will know for sure if the trainings are making any sense to them, if you collect feedback. Moreover, today's audience are highly creative and seek interesting content. Most trainings in market today are dated and were never built on a feedback mechanism. The only feedback that mattered were of a few security leaders, who are not the real beneficiaries of security awareness training. This has got to change, and SyberNow is changing that!