Closing the Gap During Cybersecurity Awareness Month: Aligning Perceived and Actual Human Risk

July 31, 2024

As Cybersecurity Awareness Month rolls around each October, it’s an opportune time for security awareness training leaders to reflect on and address the current landscape of human risk within their organization.

In the past several years, cybersecurity awareness has significantly improved, with more organizations prioritizing employee training and education on security best practices. Phishing simulations and regular security drills have become common, helping employees to recognize and respond to threats more effectively. The adoption of user-friendly security tools and the accessibility to training programs and awareness campaigns has made it easier for people across an organization to follow best practices without extensive technical knowledge. Even increased media coverage of high-profile cyberattacks has heightened cyber threat awareness and driven the public to be more vigilant when it comes to identifying suspicious emails, improving password hygiene and downloading software security updates.

Despite all the positive changes, a persistent gap remains between the perception and reality of human risk.

Perceived Human Risk vs. Actual Human Risk in Cybersecurity

Human risk in cybersecurity refers to the potential for employees to compromise security through actions like falling victim to phishing scams, using weak passwords, mishandling sensitive data, failing to follow security protocols or improperly using company technology. While many organizations believe they are adequately addressing these risks, the reality is often quite different.

The human risk gap is the inconsistency between perceived risk posed by human factors in cybersecurity and the actual risk. This gap widens when organizations underestimate or miscalculate the impact of human behavior on their organization’s security posture. The fact remains that human error is a leading cause of data breaches, with 68% of breaches being attributed to the human element in the Verizon 2024 Data Breach Investigations Report.

Whether your cybersecurity awareness program is new or mature, overconfidence in the sufficiency of current security awareness measures can lead to complacency, leaving significant vulnerabilities unaddressed. This is especially evident when security training initiatives end up being more like predictable checkboxes than hands-on experiences based on dynamic, real-world threats.

The Leadership Disconnect in Cybersecurity Awareness

One of the primary reasons for the human risk gap is the lack of prioritization from leadership.

Take a look at the 2024 Cybersecurity Threat and Risk Management Report report from the Ponemon Institute and Optiv, which surveyed responses from 650 IT and cybersecurity professionals about the latest industry trends, investments and priorities to manage risk.

According to the report, cybersecurity budgets are increasing; 59% of survey respondents say that their 2024 budget has increased from the previous year, and 39% of respondents indicated that their organization plans to invest in security training for employees.

While many organizations have allocated significant budgets for advancing cybersecurity awareness technologies and services, a reoccurring challenge remains: the prioritization of cybersecurity awareness culture. Without a strong mandate from the top, cybersecurity awareness initiatives can fall by the wayside. Leaders play a crucial role in setting the tone for cybersecurity culture within an organization. Their active involvement and prioritization can drive significant improvements in reducing human risk.

Steering Cultural Change

It’s proven that organizations with a strong security culture experience fewer incidents and faster recovery times when breaches do occur.

To close the gap, it is the responsibility of security awareness training leaders to drive a cultural shift in your organization. Here’s how:

Leadership Commitment

Leaders must be visible advocates for end-user cybersecurity. Their commitment will encourage employees to take the matter seriously. As a security awareness leader, it is up to you to gain leadership buy-in. You can achieve this through consistent communication that aligns cybersecurity awareness initiatives with business objectives, conveys compelling data to demonstrate the significance of cyber risk and shares real-life examples of human risk.

Continuous Real-World Simulations

The idea of simulated phishing is not a new one. It is common for advanced phishing simulations to involve carefully crafted emails to employees on a random, recurring basis. However, it is uncommon for security awareness leaders to examine how simulations are applied, measured and responded to. Frequent, realistic simulations that focus on encouraging positive behaviors can drastically influence the security awareness culture at your organization to become one where employees feel responsible for protecting organizational data.

Expand Avenues to Awareness

Training is not a one-time event, but an ongoing effort. Security awareness and education should be seamlessly integrated into the organization’s communication channels. In today’s rapidly changing digital landscape, traditional, one-size-fits-all security compliance training may no longer be sufficient. Diverse learning opportunities can include interactive e-learning exercises, in-person workshops and personalized training paths. By increasing your end users’ exposure to quality cyber awareness content, security training can move beyond simplistic messaging and instead drive impactful change.

Open Communication

Create an environment where employees feel comfortable reporting potential security issues without fear of repercussions. Invite continuous feedback from your employees on security policies and practices to identify potential areas for new or updated training.

Employee Empowerment

End-user security must be as easy to follow as it is easy to fall victim to an attack. Consider user friendly tools, automated processes, clear guidelines and consistent reminders. Always recognize and reward employees who demonstrate strong cybersecurity habits and actions.

Conclusion

Cybersecurity Awareness Month presents the perfect opportunity for security awareness leaders to bridge the gap in human risk. By prioritizing leadership engagement, driving cultural change and making security practices user friendly, we can significantly reduce the risk posed by human behavior.

Cybersecurity is a collective effort that requires ongoing commitment and proactive measures. Turn awareness into action and make Cybersecurity Awareness Month a turning point in your approach to reducing human risk.

By:

Emily Wienhold

CYBERSECURITY EDUCATION SPECIALIST | OPTIV

With a proven track record as a Security Awareness Professional for a Fortune 200 organization, and GRC experience working for a Fortune 100 organization, Emily brings a unique blend of strategic insight and operational expertise to the realm of cyber awareness and education. Emily is passionate about fostering a security-conscious culture that empowers employees to become vigilant guardians of their personal and professional digital footprint.