New Survey Reveals Cybersecurity Training is Missing the Mark as Employees Work around Company Security Policies
The survey, conducted by Forrester Consulting, found that while 59% of security and IT managers think they are ‘ticking the security compliance box’, their employees report a huge disconnect. More than half of the 240 employees surveyed in APAC (53%) disagree with that statement, and 51% believe their managers do not stress the importance of good security practices.
The survey was conducted across
The survey included a wide range of questions around Security Awareness and Training (SA&T) Programs in APAC, including security measure and implementation, employee behaviour changes, security culture and overall effectiveness in delivering effective training programs. Results of the employer survey were measured against feedback from 240 knowledge workers within these companies, who regularly use email and digital channels in the workplace.
Across the region the study also found that attending SA&T activities does not necessarily translate to a change in behaviour for employees, with a third of SA&T attendees still admitting to flouting security policies -- increasing to more than 50% for respondents in
“While security leaders in APAC believe they’ve made security a social norm by leading and encouraging others, this survey underscores that employees are not retaining, understanding or implementing key areas of cyber security training – and the existing outdated modes of training are simply not bringing about behavioural change,” said
“In the current COVID-19 business conditions, with many employees working remotely indefinitely, the last thing businesses need is a security breach.”
Additional findings from the
- Traditional SA&T is long and unengaging, uses outdated content types, and does not rely on behavioural science to achieve its objectives of behaviour and culture change.
- As a result, employees’ behaviours are not changing, which further contributes to a disconnect between employers’ perceptions and how their employees really feel about security.
- APAC firms must advance SA&T programs by exploring alternative content types, providing different methods of delivery based on employee preferences, and extending training outside the workplace.
“Almost half of business leadership teams (45%) still have the incorrect perception that security impedes their workforce productivity,” as noted in the study by Line Larrivaud,
“At a time when global cybersecurity threats, customer data breaches and the potential for reputational damage has never been greater, it’s of vital importance that business leaders and employees understand and value the importance of cyber security best practice within their organisation. They simply cannot ignore the consequences or circumvent the protocols,” commented Lennon.
Laura Rapsonpress@mimecast.com +27723790481
Source: Mimecast Limited