A marked uptick in cybersecurity awareness programs across all industries in the last year has resulted in a higher level of security at a majority of enterprises.
This is among the findings of ThriveDX’s newly-released “2022 Global Cybersecurity Awareness Training Study”, which polled more than 1 900 CISOs, security leaders, and IT professionals.
Almost all of the organisations surveyed, a total of 97%, reported implementing some type of cybersecurity awareness training measures this past year, with most now using a combination of both phishing simulations and security awareness training.
However, just 42% reported involving their employees in security detection with the use of such measures as a Phishing Incident Button. It’s an important distinction as this type of engagement is known to further security by creating a virtual ‘human firewall’ and accelerating the reporting of potential threats.
“These statistics tell us two things. The first is that cybersecurity awareness is now reaching its adolescence with almost universal agreement that regular training improves enterprise security in a way that technology alone cannot,” said Aaron Bostick, CISO: North America at ThriveDX. “Secondly, these numbers show us that we still have a long way to go to reach maturity and an understanding that the only true way to mitigate modern cyber risks is by positively changing employee behavior and building positive security cultures within our companies.”
Sixty-five percent of IT professionals surveyed did agree that their cybersecurity awareness training programs need expansion, and no one indicated a desire to reduce their current engagement.
The results of employee awareness efforts were impressive across the board with 19% reporting better awareness; 14% greater vigilance; 12% said they increased their human firewall; and 99% reporting an increase in corporate security. Ninety-six percent also noted a positive influence on their enterprise’s overall working atmosphere.
Survey participants reported that the most important success factors were training course duration, an entertaining nature, customisation, and individualisation.
“This really validates the human-centric approach that we take towards security awareness,” says Roy Zur, CEO of ThriveDX for Enterprise.. “Involving employees, offering customized security awareness training, and gaining their commitment to security is the number one way to mitigate cyber risk.”
The survey also found that the most popular training topics are courses on phishing and malware, password security, email security, social engineering and ransomware.
Seventy-two percent of companies refrain from pre-announcing phishing campaigns to employees.
The biggest challenges cited in implementing awareness programs were achieving user acceptance (25%), workload and resources (22%) and program execution (14%).
The use of mission statements, policies, guidelines, metrics and systematic training is increasing with 58% of respondents reporting some form of security awareness regulations in place.