Security awareness training fails because it ignores what people actually care about. Frame it around connection, money, health, and status instead of just protecting the company, and employees will actually remember it.
The problem with security awareness training today, and the reason most people will just put it up on their screen and go grab coffee till the timer runs out, is because there is very little linkage and relevance in the way it's delivered to them. People— this is just unfortunate, but people have a lot going on. They want to get through these things. And when you have to sit them through training, the reason retention is really low is because they're not really engaged. It doesn't really add value to them. Even when I was going through my own security awareness training at my company, it all kept talking about, "This is how you can protect your organization from getting hacked and breached." And I could sense that people are like, "But I mean, why would I care about my organization getting hacked? I mean, okay, I would, but like, whatever," right? If you switch that to making it relevant to that person, you know, when you look at it cognitively, Humans care about some primary things. We have to bring it down to the human level. Connection and love, their wealth and financial security, health, and usually status or, um, like social cohesion. If it's not related to one of these things for them, it's not going to stick.
The Future of Cybersecurity: How AI Is Exploiting Technical, Behavioral, and Process Vulnerabilities
