What do you do if your cybersecurity awareness campaign needs a creative boost?

Along with the freshness of the content, the 'relevancy' also matters the most. Employees relates to the content that is connected to the job that they perform (E.g CEO Fraud or bank transfer frauds for finance staff, change of bank a/c frauds for HR staff, malware-laced RFP to a sales employee etc.). Instead of a vanilla content on a subject (say Do's and Dont's on laptop protection while travelling), tell a story (Mr X is travelling, stowed the laptop far from the seat, device not in the line-of-sight, someone else picks it up and de-boards) - people remember stories better than news!!

Para revitalizar nuestra campa?a de ciberseguridad, debemos abrazar el poder de la narrativa y la experiencia vivencial. Una imagen, un relato vívido, tienen el potencial de impactar más que mil advertencias. Al conectar con casos reales y cotidianos, como la pérdida de un dispositivo crítico, no sólo ense?amos, sino que hacemos sentir la importancia de proteger nuestra información. Si logramos que cada persona interiorice esta realidad a través de una experiencia que toque fibras, estaremos no solo transmitiendo un mensaje, sino también cultivando una cultura de seguridad robusta y consciente. Recordemos: a veces, cómo decimos algo, es tan importante como lo qué decimos.

Including recent case studies of security breaches that affected local companies within your country may also help paint a better picture of the impact of cyber risks when customising campaign content. If a recent attack affected a company within the same/similar industry as your own - chances are the trainees or targeted audience for the cybersecurity campaign will relate better with the breaches, and possibly boost awareness significantly.

Create engaging content like quizzes, games, or simulations to make cybersecurity training more enjoyable and memorable for employees. Utilize infographics, animations, or short videos to convey complex cybersecurity concepts in a visually appealing and easy-to-understand manner. Incorporate real-world case studies or scenarios to illustrate the potential consequences of cyber threats and emphasize the importance of following security protocols. Tailor cybersecurity training programs to individual employees' roles, responsibilities, and knowledge levels. Establish channels for employees to provide feedback on the training content and delivery methods, allowing for continuous improvement and optimization.

Inject creativity into your cybersecurity awareness campaign by gamifying learning experiences. Host interactive workshops, quizzes, and challenges. Utilize humor in educational materials to engage and entertain. Remember, a spoonful of humor helps the cybersecurity lesson go down! As the saying goes, "Laughter is the best medicine, even in cyberspace," and "In cybersecurity, a little humor goes a long way."

Present users with realistic scenarios where they have to make security-conscious decisions. This helps them apply their knowledge to real-world situations. Conduct simulated phishing attacks where users have to identify and report suspicious emails. This helps them develop a critical eye for spotting phishing attempts.

I have attempted three innovations in three different settings, of three different types, including one from personal life but that gives ideas for the corporate world also. I will write in the next three questions. From the IEEE Platform, I have developed short movies for training and awareness about cyber crimes. Three movies so far, based on real incidents, from my own life. I have written the script, and given the direction, while young girls and boys from a technical college have played different roles. The movies end with a summary of key messages. While created from the IEEE platform, these are equally good for non-IEEE members of all ages and back grounds. On purpose, I have kept the language very easy and simple.

An effective way to reach out to users is through interactive learning, but that needs a creative admin that will provide the contents or a subscription that will provide such a solution,, and a follow-up on the provided tools is important.

Cómo algo que funciona puedes crear simulaciones de ataques virtuales y juegos donde cada uno aprenda jugando, enfrentándose a situaciones reales de forma segura. La finalidad es lograr que la información sea más fácil de recordar y a la vez menos aburrida. Podríamos organizar competiciones interactivas para aplicar lo aprendido en desafíos prácticos, creando un ambiente educativo y entretenido. Con la realidad aumentada podemos aprender jugando desde el sillón de casa y no necesariamente en una aburrida sala de formación. El futuro de la inteligencia artificial omnipresente está aqui, y quienes no abracen el cambio, corren el riesgo de extinguirse como les pasó a las especies que no evolucionaron.

Learn more about cybersecurity with interactive learning experiences. Use fun activities like games, tests, or escape rooms to keep people interested. Use workshops, role-playing scenarios, or simulated phishing exercises to learn. Encourage people to give feedback and work together to get more involved and stay involved. By making cybersecurity education interactive and immersive, you help people use knowledge effectively and create a culture of vigilance and resilience against cyber threats.

Whenever you encounter a complicated subject like cyber, everyone likes to turn off their minds and watch a good video. As of 2024, 85% of LinkedIn users preferred watching videos over reading text. When users watch a video, they are more likely to stay on your page, increasing their engagement with your brand. This extended engagement sends positive signals to social media algorithms, boosting your organic reach and visibility. Additionally, videos are more likely to be liked, shared, and commented on. LinkedIn users are 20 times more likely to reshare a video post. Next time you create a cybersecurity awareness campaign, keep that in mind.

Infographics, charts, and diagrams can effectively represent complex data and processes, making them easier to grasp than text-heavy content. Explainer videos with animation or motion graphics can effectively convey cybersecurity concepts in a clear and concise manner.

The second innovation has been the introduction of a CyberSec. Crossword Puzzle. This idea was generated when a corporate asked me to run a session for their senior management. So, I designed a puzzle specific to their organisation (after reading their plans). Normally played on printed paper, or on machines - I cut the alphabets on thick, laminated paper and they would need to make the words on the table. A ransomware attack scenario was built where the hackers would ask to solve the puzzle to get the key to release data/ machines. Played as a game between two teams, it has competition, they would have to develop strategies to tackle the situation and make quick decisions. I kept adding spice to make the going difficult/ interesting.

Use visual aids to get your audience interested in your cybersecurity awareness campaign. Use graphics, infographics, and videos to tell key messages in a memorable way. Make posters, banners, and digital signage to reinforce cybersecurity best practices in the workplace. Use stories and pictures to make complicated ideas easier to understand. Using pictures and pictures can help people understand and follow cybersecurity rules better.

Interactive videos and Infographics can be effective for complex cybersecurity concepts. Even we can leverage memes and GIFs to add humor and relatability with audience. Develop interactive tools and simulations that allow users to explore cybersecurity concepts and scenarios in a hands-on way. For example, we may create a phishing simulation tool that lets users practice identifying and responding to phishing emails.

Personal stories can indeed resonate deeply with people and effectively highlight the importance of cybersecurity. Sharing anecdotes about individuals or organizations that have experienced cyber threats can illustrate the real-world impact of such incidents. This approach helps to humanize cybersecurity, showing that it is not just an IT issue but a personal one that can affect anyone. This personal connection can make the campaign's message more relatable and impactful.

Stories tap into our emotions, making the message of cybersecurity more personal and engaging. People are more likely to remember a story than a dry list of statistics.

I then wanted to raise this awareness at home also. So, I designed a simpler, generic version of the crossword puzzle (the members' age ranges from 7 to 64 years, in my extended family of 20 people). Keeping the game/ quiz/ puzzle interesting to all people in the family is a much bigger challenge than a paid session in the corporate world! The clues will come from history, books, poems, science, mathematics etc. This 7 years old boy would at any moment say 'I am bored' or 'this game is boring'. So, further innovations on the fly: a) the boy will act as in dumb charades, and the others would have to guess the word. b) the clue is a sentence, but I would add some movie/ song/ poem, character, or a family happening as an additional clue.

Present learners with real scenarios and case studies that illustrate common cybersecurity risks and dilemmas faced in the workplace. Encourage participants to share their experiences and how they dealt with it or could deal with it more professionally.

There will always be someone you know locally that has experienced a cyber attack, be it personally or through their business. Doesn't matter if you live or work in a large city or a small town. If you hear someone local sharing a story about a cyber attack they dealt with, connect with them and ask if they'd be willing to share their story with your company and employees. Most of the time, they'll be happy to help others avoid the same fate and share their lessons-learned. If you don't know someone personally, odds are you've got a local cybersecurity professionals group you can join up with and ask folks there. Personal stories always resonate with other people, and in my opinion, are the BEST cybersecurity education tool available.

In my experience, Choose experts who specialize in areas relevant to your audience's needs and the focus of your campaign. Encourage experts to share case studies or real-world examples that illustrate the importance of cybersecurity best practices.

Another thing I've learned on my cybersecurity education journey is that the FBI, the Secret Service, and CISA are almost ALWAYS willing to come speak to businesses and groups about cybersecurity. You will have to work around their schedules, but it's 100% worth the wait. Depends on where you live, your local police department may also be able to speak on cybersecurity as well. Their stories and insights are generally industry-agnostic, however. If you work in an industry with different/specific cybersecurity regulations or needs, there are typically cybersecurity experts that work with your industry that would be more than happy to come speak to anyone that will listen - even your customers!

Use expert insights to give new life to your cybersecurity awareness campaign. Collaborate with industry leaders, cybersecurity professionals, and thought leaders to provide valuable perspectives and guidance. Host webinar sessions, panel discussions, or Q&A sessions where experts share their knowledge and experience. Use their credibility and experience to reinforce key messages and inspire action. Encourage audience interaction and questions to build engagement and understanding. By using experts' advice, you can make your campaign more real and convincing. This will also give your audience useful advice and plans to follow.

This is an interesting proposal. So far, I have observed awareness trainings as part of mandatory/compliance. Apart from making the awareness trainings more interactive and engaging, incentivising it with some kind of rewards would definitely drive interest and more participation. The reward need not be monetary. It would be as simple as say org/team leader-board tracking the active engagements from the folks. Or, digital badges to show off on social platforms or simply in the email signatures. #DTalks

There needs to be a 'skin in the game' for employees towards cyber and what better than rewarding good behaviors and induce positive reinforcements! In my previous two org's, we introduced a 'Cyber Sentinel' award to people who demonstrates intuitiveness, diligence and cyber-aware mindset; we reward them every month with a certificate, call them out on the All-Hands, and personally congratulate them. A token of appreciation indeed goes a long way!!

My forth short movie also on cybercrime, is inspired from a UK government cyber security awareness program. So, I picked the good practices suggested there. Then built a script around those to develop a model phishing mail! This I fed into an AI Agent to develop a video for me (using a free version so far). Then I added my pictures on top of that, edited some of the text generated by the AI Agent, and added key messages and a closing scene. This is such a fun to do this and then play that video for others to watch and learn. Great learning for me also. Highly encouraged, I am inclined to buy a licensed product and use it extensively in my next cybersecurity course as well as other courses.

Ensure your content is relevant to the business' industry. And make it compelling. Ensure your content is relevant to the business' values and risk posture. And make it compelling. Sprinkle elements of "true crime" and current events into your conent. And - you guessed it - make it compelling. Affirm and confirm that your cybersecurity awareness program has backing from the leaders in the organization. Remind staff that it does. And why.

Do not rely on information, search the Internet and research. Modern society is an information society. We are inundated with information. There is a mixture of harmful and harmless information. It is necessary to be discerning. The importance of learning through online courses. Participate in the community, attend events, and engage in discussions. Subscribe to newsletters and stay up-to-date. Get expert opinion, advice and guidance. Networking. Utilize Linkedin services through social media.

Involve your security champions in your awareness campaign planning sessions. They are closer to users and developers than most cybersecurity experts and can offer a better perspective of what your audience wants in terms of activities.

Cybersecurity is Everyone's Responsibility. Phishing Simulation Test (PST) helps to evaluate the likelihood of user falling for a phishing attack. Effectiveness of any Cybersecurity Awareness Campaign (CAC) is NOT ON KNOWING, but ON RESPONDING to threats, by reporting any security incidents or suspicious activities or phishing/suspicious mails. Organizations should continuously strive to maximize User Response by: i) Promoting a Positive Work Culture: Encourage all users to report security/suspicious events, Provide follow-up training for Non-responders and users clicked on phishing link, after a PST. ii) Keeping Leadership Informed: Periodically update Leadership on User Response trends.