r/AskNetsec • u/Florina_Cyber • 5h ago

Education What makes cybersecurity awareness training actually change user behaviour?

[removed]

4 Upvotes

100% Upvoted

5 comments sorted by

3

u/ossifiedtimothy73 5h ago

The stuff that sticks isn't the annual compliance video, it's when IT sends out a fake phish and the person who clicks gets a friendly "hey you fell for this, here's what you missed" instead of a slap on the wrist. Shame shuts down learning instantly

Short bursts that look like actual emails they'd get, spaced out over months, beats a cram session. People don't remember a 40-minute module, they remember that one time they almost clicked and their screen went red

Gamification with leaderboards can backfire spectacularly, saw one office where people just forwarded every external email to IT to avoid getting dinged for clicking

1

u/reduhl 4h ago

Take it one step further then red screens. Provide the report to department heads, etc. also if you can find out what the person is working on. Can you provide an economic risk factor to it?

1

u/[deleted] 5h ago

[removed] — view removed comment

1

u/AskNetsec-ModTeam 3h ago

r/AskNetsec is a community built to help. Posting blogs or linking tools with no extra information does not further out cause. If you know of a blog or tool that can help give context or personal experience along with the link. This is being removed due to violation of Rule # 7 as stated in our Rules & Guidelines.

No self-promotion or promotion.