Apathy Is Your Company's Biggest Cybersecurity Vulnerability — Here's How to Combat It

Deliver tailored security awareness training programs. Global spending on security training continues to rise, but the reality is that most employees aren't engaged in this training. Nearly half (48%) of the security leaders surveyed by Tessian say that training is one of the most important influences on a positive cybersecurity posture. Despite that, only 28% of employees say security awareness training is engaging, and only half say that it is helpful. This is a major disconnect.

Security training should be tailored to individual employees based on factors such as department, tenure, and geography. For example, teach remote employees about the specific types of scams that could target them, whereas the finance department should see real-world examples of wire-transfer fraud and related financial swindles. Rather than yearly or quarterly trainings, employees should receive the information they need in the moment to give context around their own cybersecurity behaviors and help them avoid mistakes.

Implement a strong but simple incident-reporting process. A similar disconnect between security teams and employees exists when it comes to the incident-reporting process. Tessian found that 80% of security leaders believe robust feedback loops are in place to report incidents, but nearly half (45%) of employees don't know who to report security incidents to. A well-defined, accessible reporting process can make it easy for employees to flag potential incidents and give security teams greater visibility into the organization's risk.

For example, security teams can institute a single, defined process such as an email address or a phone number that employees can use to flag a suspicious email or potential cybersecurity incident. Often this process can be automated, as opposed to pulling in security team members at all hours and risking burnout. A strong reporting process will be predictable, automated where possible, and easy for employees to access without fearing they will be punished for making a cybersecurity mistake.

Drop the fear, uncertainty, and doubt. Punishing or shaming employees for making mistakes can lead them to disengage or feel apathy toward the cybersecurity culture. Employees won't trust nor want to engage with a security team that relies on fear or negative reinforcement.

Tessian's report found that half of employees have had a negative experience with a phishing simulation. Recent headlines show the type of backlash that can occur when companies use "gotcha" style phishing techniques designed to trick employees. Techniques like this can create an adversarial relationship between the security team and the rest of the company.

A strong cybersecurity culture instills collaboration and uses positive incentives to engage employees. For example, reward employees who flag a cybersecurity incident, spot a suspicious email, or complete a training. It doesn't have to be a major investment. Peer recognition can go a long way.

Align with the HR team. Lastly, security training and best practices can be woven into the entire employee life cycle to foster and maintain a risk-aware organization. Security teams should partner with HR to play an active role in onboarding, offboarding, and day-to-day processes. For example, give new employees information on incident reporting and real-world examples of the scams that often target new employees.

Similarly, during the offboarding process, employees should be reminded of data security processes, including why they cannot take documents and other information with them to a new job. In a separate Tessian report, 45% of employees admitted they've taken data before leaving or after being dismissed from a job. This isn't always done maliciously — many employees aren't aware of when documents belong to them and when they don't — so it's important to provide guidance.