Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Incentive Approach Against Phishing

9 Jan 2025 · 1 min

Watch on YouTube

0:54

In this brief segment, the speaker advocates for an incentive‑based (“carrot”) approach to building a strong security culture. Rather than relying on punitive measures, organizations should recognize and reward employees—through monetary, non‑monetary, or gamified incentives—for proactive security actions such as reporting phishing emails. The speaker argues that such incentives make security activities exciting, encourage vigilance, and can be systematized and scaled across the enterprise, ultimately saving companies millions by reducing losses from social engineering attacks.

Chapters

What propels security culture is the carrot approach, the incentive approach, maybe being recognized for, or actually incentivized, or even non-monetary compensation, you know, ways to reward someone for taking a step that protected the security of a company, be it even just reporting a phishing email, right? Like, make it exciting for people, make them want to like find it and keep an eye out for it because it gives them something of value to do that, as opposed to just being punishment, then there are ways we can change culture in sentiments. So it can be done. We just need to— we said it can be systemized and scaled, and we can just show that that is a better way of saving company millions in losses due to social engineering.