Employees are resistant to cybersecurity training. Are you missing out on crucial skills for your role?

Security training needs to be relevant and engaging for the workforce. You can't keep sending the same training over and over again and expect to retain attention of the audience. I've taken to recording my own, targeted content for our staff to ensure the content is relevant and engaging. Although it does take a bit more time the payoff is huge. Security teams can only illicit so much control centrally, and we have to educate the workforce and empower them to be impactful at the edge.

The workforce is seldom "resistant" to training, the issue is usually that corporate training is boring and not applicable to daily routines. Making training short, interesting, and impactful is a skill that sits between HR and Marketing in a lot of ways - if your program has a training resource, that's ideal, otherwise we work with what we have. I want to make the training make sense in everyday life - if your daughter gets a weird-looking email, I want our training to shed some light on warning signs in the message. If my users share with the rest of the family, that's a good thing, it means that vigilance is a daily thing. My missing "skill" is resource-based, be it time, training resources, or an implementer.

Cybersecurity is a rapidly evolving field, and it is not a static skill set. Continuous learning and staying updated with the latest threats and defenses are crucial. If employees are resistant to cybersecurity training, it can increase the skills gaps in their roles. To avoid resistance, review the content of the training to ensure it is not outdated or irrelevant to the current threat landscape. Additionally, the training approach may not be progressive, or the knowledge level may be too shallow, which does not provide enough depth for employees to feel adequately educated or motivated.

Recognizing and addressing skill gaps in cybersecurity can actually be beneficial for your growth and the security of your organization. Skill gaps highlight areas where you can focus your learning efforts, turning them into opportunities for development. By identifying these gaps, you can prioritize acquiring the latest knowledge and skills, which not only enhances your expertise but also strengthens your organization's defenses against evolving threats. Embracing continuous learning and proactively filling these gaps ensures that you remain adaptable and effective in combating new cyber threats, ultimately making you a more valuable and resilient cybersecurity professional.

Some staff or managers may have this misconception that cybersecurity can be delt with in a corner inside IT or security department. It is important to educate your employees that this is not true, and everyone plays a role.

I believe you have to keep the content interesting, relate it to people’s everyday activities and functions and where possible make it fun

In today's world, IT and Cybersecurity are getting bigger every day. Practically, everyone has a skill gap. The question is did you have good core skills to learn needed new skills fast and efficient. The T-shaped knowledge model works best for me, you need solid fundamental skills and knowledge, but you also need to be an expert in a certain area. And keep learning. :)

Basic Cyber Security Training and awareness is mandatory in any organisation. It is one of policy which needs to followed by all employees. Infact it is for benefit of employee and employers Cyber Security hygiene needs to implement and maintained and monitoring. I don't see any challenges for employee not interested.

Training in Awareness is crucial part of any Cyber Security personnel… If you missed to attend and by lack of knowledge it leads to human error. Which may lead to big impact financially and reputation also would be in stake of respective organization.

Gamefication of the learning, and use examples that really happened, and stuff people can relate from a personal aspect as well. They'll feel more concerned. And of course, dynamic training, not boring multi choice polls.

I believe that anyone in the cybersecurity industry is naturally inclined toward learning and growth, given that cybersecurity is a rapidly evolving field. Understanding learning styles is crucial for managers to consider. By taking the time to learn about your team's individual learning preferences, a manager can effectively tailor their approach, making training more impactful. This insight can also provide valuable ideas on how to present information and strategies moving forward, ensuring that the team is better equipped to adapt and thrive in this dynamic industry.

One of the most efficient ways to ensure learning, is by making it recognizable. On the opposite, a cookie-cutter approach might lead to employees dreading the next security learning session. A couple of years ago, my team created some videos explaining different security concepts, while using ourselves as actors, our offices as the filming location, and everyday equipment like phones and PC's as props. The result was that the employees recognized us (which made it funnier), the location and equipment (which made it more "real"), and hence "connected the dots" with the message we tried to convey.

When doing training internally, tie it back to common 'personal' security techniques as well. For example, when talking passwords, talk about the need for this in online banking and other sensitive areas outside of work. If there is an IT newsletter, include something to help with a potential security issue or technical tidbit that may be encountered when not at work. This can foster a better awareness to issues, and show additional value that may resonate better with employees.

Make the training relevant to what people do in your organisation and vary up the delivery method. Positive reinforcement also helpful

I suppose the topic is interesting to you, everything goes on its own and with passion. For me, the greatest challenge is preparing for some formal exams and certifications. Here, decomposition works for me. Just split large pieces of material into small chunks and snack them daily. Give yourself small rewards for yourself.

Overcoming resistance to cybersecurity training often starts with understanding that one size doesn’t fit all. It’s important to offer varied training formats that cater to different learning preferences. From my experience, when training is interactive and directly relevant to daily tasks, it’s more likely to resonate with employees. Offering simulations or real-world scenarios can make the content more engaging and meaningful.

Cybersecurity training should be implemented as part of the workday, instead of being a mandatory/voluntary afterhours activity - only those interested and with adequate time will show up to afterhours activities, and when it comes to cybersecurity training, everyone must participate. Cybersecurity training should be viewed as an investment, both in terms of increased awareness (and reduced risk of a cyber event), but also as a way to reduce the number of inquiries towards your cybersecurity team.

Always have time to put into your professional development! Don't be afraid to ask your boss if they can plan your education as a work project. The knowledge you get on training could and will save you a lot of time on real projects. Furthermore, this could potentially serve as a highly effective risk reduction factor.

Develop a culture where people realise and appreciate it is important to undertake the training. Try to make the training short and snappy, one so it is understandable and sticks with the employee but also so it isn’t a chore and can be done in an already busy schedule

Cybersecurity should be part of your everyday routine. It simply has to be if you want it to be meaningful and effective in your organization. But how do you get there with training? Same way you learn to play a musical instrument. Short training sessions that occur often. When you force employees to slog your way through a few hours of compliance modules that only occur once per year (all at the same time), you’re going to lose your audience.

Address employee resistance with these strategies: Relevance to Role: Tailor training to specific job functions, emphasizing practical application. Engagement Levels: Use interactive formats, case studies, and gamification to boost participation. Personal Impact: Highlight how security practices protect personal data and contribute to a safer digital environment.

Mixing up the content you deliver can help. Deliver general training one month and the role tailored training the next. Work with leaders in your organisation to champion the value of the training and on some occasions they can help deliver the training in face to face or group discussion sessions

In particular for Phishing training, it goes against the nature of people. The internet is made to click and tap and we have been using it that way for decades. Trainings should be tailored to the audience, engaging and focused on how to recognize. We should build resilient systems around the fact that we are eventually going to click anyways.

I’ve run into this challenge when teaching cybersecurity classes, and the best way to get past it is to reframe things so that the concepts better apply to their situation. For example, when trying to instruct a group that has an Operational Technology background, using the perspective of cybersecurity in an Information Technology setting simply isn’t going to work. You have to understand your audience and what their specific cybersecurity challenges are going to be, then tailor the training, and delivery, to match.

Keep the training varied, make it relevant, reward people for doing the right things. Develop a culture where the employees see themselves as part of the solution and not the problem

Address employee resistance with these strategies: Relevance to Role: Tailor training to specific job functions, emphasizing practical application. Engagement Levels: Use interactive formats, case studies, and gamification to boost participation. Personal Impact: Highlight how security practices protect personal data and contribute to a safer digital environment.

I would suggest always use examples which are close to the real life of attendees. There are plenty of them. As people always think that security incident is something far away from them and they will not be impacted. This lead to false assumption that people will not be hit or are not vulnerable

Address employee resistance with these strategies: Relevance to Role: Tailor training to specific job functions, emphasizing practical application. Engagement Levels: Use interactive formats, case studies, and gamification to boost participation. Personal Impact: Highlight how security practices protect personal data and contribute to a safer digital environment.

When balancing speed and cybersecurity, follow these steps: Assess Risks: Prioritize risks based on impact and likelihood. Understand the critical assets and potential threats. Tailor security measures accordingly.

I find that the best approach to make it relevant is to identify what the relevant cybersecurity threats are based on the environment and position A PLC engineer working for a pharma company is going to have a different set of cybersecurity issues to deal with in comparison to one working for a telecom. Sure, there’s going to be some similar threats, but there are going to be a lot that aren’t. Different cybersecurity regulations to meet at well. You have to know the different and tailor the approach to match. Then you need to find and use good cybersecurity examples that affected people with similar positions in those same industries. The combination of the two usually gets, and also keeps their attention and interest.

By default, many of us are the cybersecurity advisors to our friends and family. By keeping current in our jobs, it can make us better and more knowledgeable outside of work, as well. Volunteer your knowledge to friends, family, your local community and anyone you find that might need some additional insight to bad or weak security practices.

Please keep in mind that threat actors could attack you and your company over your personal/family devices. So try to educate your family about cybersecurity and cyberhygiene basics.