The case for cybersecurity awareness training (CSAT) is becoming stronger by the day. IBM reports that the average cost of a data breach reached an all-time high of $4.35 million last year, while 83 percent of the organizations included in the report said they had been breached more than once. Considering the fact that the vast majority of breaches involve a human element, CSAT has never been more critical.
While it’s tempting to assume that these facts speak for themselves, this isn’t the case. There are always competing priorities within an organization – some can clearly see the essential role CSAT plays in keeping the company safe from crippling financial and reputational harm while others consider it a low priority. This is why CISOs and other company leaders must be capable of advocating for CSAT to their colleagues in the C-suite, managers, and employees at every level of the organization.
Building Leadership Buy-in
It’s impossible to implement an effective CSAT program without generating widespread stakeholder support, which has to be accomplished at two broad levels: within the leadership team and among employees. Let’s start with the leadership team. The CISO, CIO, and other company leaders can convince their colleagues to support the development of a robust CSAT program in several ways:
- Highlight the severe financial and reputational consequences of cyberattacks along with the fact that human error is usually the culprit in these attacks.
- Demonstrate the effectiveness of CSAT programs and propose rigorous methods for tracking the performance of these programs (such as phishing tests and individual assessments of employee strengths and weaknesses).
- Show how CSAT can improve organizational culture by giving employees an opportunity for professional development. Creating a culture of cybersecurity will also make cybersecurity second nature for employees and prevent future cyberattacks.
How to Win Employee Support
Generating support for CSAT among employees is crucial because doing so will drastically reduce the number of vulnerabilities cybercriminals can exploit. Here’s how to earn employee buy-in:
- Make CSAT content relevant and engaging. Employees should be learning about the latest cyberattacks – the tactics cybercriminals use, the attack vectors they exploit, and how their attacks can be thwarted.
- Personalize the educational process. Employees have different strengths, weaknesses, skills, temperaments, and learning styles. By taking a personalized approach to CSAT, it’s possible to focus on the areas where employees need the most reinforcement and engage them on a more individual level.
- Present CSAT as a professional development opportunity. Employees are embracing workplace education, as they recognize that the economy is becoming more skills-based and competitive all the time. Cybersecurity awareness is a valuable asset, which is why CSAT should be reframed as an opportunity for learners.
If there’s one cybersecurity myth that should have disappeared long ago, it’s the idea that small groups of IT professionals are the only ones responsible for keeping organizations safe. Cybersecurity is everyone’s responsibility, which is why the process of securing stakeholder support should span the entire company.
