Discussing Cybersecurity

❚

23–35 minutes

reading

·

Building a Cyber-Aware Culture

A practical guide for senior leaders on cybersecurity awareness training, human cyber risk, employee behaviour and measurable business resilience

A surreal pavilion supported by five structures symbolising leadership, working conditions, usable controls, incentives and learning
Cyber-aware culture depends on the conditions that make secure work practical (after Magritte)

Executive Summary

An organisation can achieve near-universal completion of its annual cyber-security course and still leave people unsure what to do when a supplier changes its bank details, a sensitive file is shared incorrectly or an unfamiliar sign-in prompt appears. For leaders, the question is not simply whether everyone received the message, but whether the appropriate response is clear, practical and supported.

Building a cyber-aware culture therefore means looking beyond the communications calendar to leadership, working conditions, usable controls, incentives and learning. Awareness helps people recognise when something needs attention; education develops understanding and judgement; training provides practice in specific skills. These approaches support secure work, but cannot replace sound systems, workable processes or organisational accountability. That distinction reflects the National Cyber Security Centre’s (NCSC) cultural principles and its warning against relying excessively on people to identify phishing.

Start with a few important behaviours, remove obstacles and act on feedback. Human resources (HR), the function concerned with people and employment, and learning teams should make delivery relevant and accessible; information technology (IT) and security teams must ensure that tools, reporting routes and response arrangements work. Leaders need several forms of evidence, not a single completion percentage or simulation score from a phishing simulation, an authorised exercise using imitation scam messages. A focused 90-day pilot offers a proportionate way to establish this improvement cycle, including in smaller organisations, not a deadline for declaring the culture transformed.

Culture is shaped by how work gets done

The NCSC describes cyber-security culture in terms of what is collectively understood to be normal and valued at work. Its principles address the conditions that enable secure behaviour, rather than prescribing an identical programme for every organisation. A policy may ask staff to verify unusual requests; everyday decisions reveal whether delaying a transaction to make that check is treated as professional judgement or an unacceptable inconvenience.

Consider a hypothetical purchasing team facing an urgent deadline. Its members have been taught to challenge changes to payment instructions, but the approved supplier directory is incomplete and the manager rewards speed without discussing verification. Another reminder to be vigilant does not resolve the conflict. The finance owner should provide an independent verification route, give staff authority to pause the change and ensure that urgent exceptions receive proper approval. Learning then explains and rehearses a process that the organisation can actually support.

Behavioural research reinforces the need to examine these conditions, without guaranteeing results. A 2018 evidence review by the European Union Agency for Network and Information Security (ENISA), now the European Union Agency for Cybersecurity, an agency of the European Union (EU), found that many models neglected workplace context and competing demands. It favoured enabling appropriate behaviour over relying on threat awareness or punishment, while identifying limitations in the available research. Before commissioning another course, establish whether the difficulty lies in understanding, the process or the conditions of work.

Learning also has boundaries. Email filtering, which screens messages for unwanted or harmful content, properly configured access controls, which govern who may use information and systems, supported devices and incident-response arrangements address risks that cannot sensibly be delegated to individual attention. Incident response means handling and mitigating security incidents. The NCSC recommends layered phishing defences, with user education alongside technical and procedural measures. Leaders should first ask which risks can be removed through design, then identify the decisions that still require human judgement. The programme may therefore need to change a system or approval process, not just its learning material.

Five geometric zones surround a shared workspace, representing the organisational conditions supporting secure behaviour
Learning works within a wider system of organisational support (after Mondriaan)

Understand the obligations without overstating them

This organisational approach also requires a clear distinction between legal duties and guidance. In the United Kingdom (UK), Article 32 of the United Kingdom General Data Protection Regulation (UK GDPR) requires controllers and processors to implement technical and organisational measures appropriate to the risk. A controller determines why and how personal data, information relating to an identified or identifiable individual, is processed; a processor processes it on a controller’s behalf. Completing training alone does not satisfy Article 32’s wider requirements (United Kingdom General Data Protection Regulation [UK GDPR], 2016, art. 32). The Information Commissioner’s Office (ICO) training toolkit sets out expectations for a needs-based programme, senior support and coverage that includes temporary and contract staff. This is regulatory guidance, not a separate universal statutory course specification. The ICO flags it as under review following the Data (Use and Access) Act 2025, so check its current wording when revising programmes.

EU operations require a separate scope check. Under Article 20(2) of Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (the second Network and Information Systems Directive, or NIS2), Member States must ensure that members of the management bodies of essential and important entities receive training. They must also encourage those entities to offer similar training regularly to employees. Article 21(2)(g) separately includes basic cyber hygiene, routine practices for protecting information and devices, and cyber-security training among risk-management measures. These provisions do not create a blanket UK training obligation: applicability depends on the entity, jurisdiction and national implementation (European Parliament & Council of the European Union, 2022, arts. 20–21). National Institute of Standards and Technology (NIST) learning guidance, meanwhile, is United States-origin guidance, not UK legislation. Review sector requirements and contractual commitments separately rather than inferring them from general good practice.

Separate legal, scope-checking and guidance objects sit on a shared desk, emphasising that they answer different questions
Check the duty, its scope and the status of the guidance separately (after Dali)

Give awareness, education and training different jobs

Within those responsibilities, each form of learning needs a clear purpose. Awareness concerns recognition and attention: noticing an unexpected request and remembering that help is available. Education concerns understanding and judgement: knowing why a request could create risk and how context affects the decision. Training concerns practised skills: carrying out verification, reporting or recovery through the organisation’s actual process. These are working distinctions, not isolated products. NIST’s learning-programme guidance places needs assessment, delivery and evaluation within a continuing lifecycle (Merritt et al., 2024).

In a hypothetical file-sharing example, an awareness message reminds colleagues to check external recipients. Education explains the difference between an attachment, an unrestricted link and access granted to named recipients. Training asks participants to share a non-sensitive sample document with the appropriate permissions, check the result and remove access. The platform owner should configure suitable defaults and make those choices comprehensible. If the safest option is unavailable, the answer is not to mark the learner down; it is to raise a design issue.

Choose the intervention according to the gap. A short reminder may suit a familiar process that is rarely needed. A facilitated discussion may be more useful where colleagues must evaluate competing obligations. A demonstration followed by supported practice suits a new tool or procedure. Do not assume that a longer course is more effective, or that a shorter one produces lasting change. Decide in advance what participants should be able to explain or do, and select an assessment that tests that capability rather than memory for policy wording.

Connect these approaches at the point of work. A prompt can lead to a concise explanation, a practical exercise and an accessible job aid. Managers should make time for that sequence. The aim is not to turn every colleague into a security specialist, but to develop the capability their decisions require.

Three views of a file-sharing task show noticing a concern, understanding access choices and practising permission settings
Recognition, understanding and practice contribute different capabilities to the same decision (after Picasso)

Make leadership and reporting credible

Putting that learning into practice requires leadership decisions, not just introductory videos. The executive sponsor should set priorities, resource delivery and resolve conflicts between security requirements and operational targets. Business owners remain accountable for their processes; HR and learning professionals shape development; security and IT provide risk expertise and functioning controls. These responsibilities reflect the NCSC’s emphasis on leadership advocacy and the Government Cyber Unit’s people-centred approach. The latter was published for government security teams: it can inform other organisations but is not binding on them

The response to a reported mistake is a practical test of that commitment. First establish what happened, provide clear instructions and preserve the information responders need. Thanking someone for raising a concern does not mean deciding immediately that every action was acceptable. Keep learning separate from any fair, established process for deliberate misconduct. Rather than promise absolute immunity, explain how good-faith reporting will be supported and how the information will be used.

Reporting without blame also requires a usable route. Give colleagues a clear contact or reporting function, an alternative if their normal account is unavailable, and practical guidance on urgent situations. They should not need to determine conclusively that an event is a cyber incident before asking for help. The NCSC’s phishing guidance supports straightforward reporting as part of a layered defence. Test the route with people using different devices and working arrangements, and check that somebody is responsible for receiving and acting on reports.

In a hypothetical remote-working case, a colleague reports approving an unfamiliar authentication request, a request to verify identity before granting access. The response should direct them to the approved urgent support route, not ask them to investigate independently or broadcast account details in a group chat. The identity-service owner takes the containment steps specified in the incident procedure to limit the incident’s spread or impact; the manager protects time for the response. Afterwards, the team can ask whether prompts were confusing, reporting was accessible and account-recovery arrangements for regaining ownership of an account were adequate. The lesson is about the whole response, not a judgement about an individual.

Close the loop by acknowledging reports, explaining what happens next and sharing improvements in anonymised formwhere sensitive details can be protected. Seek feedback from people who found the process difficult as well as those who used it successfully. Local champions can surface questions, but need a clear remit, time and an escalation route. They should not become unpaid incident responders or substitutes for a properly supported service.

Strong authentication and contextual signals inform proportionate access decisions, with additional checks, review and recovery
Context should strengthen authentication decisions without obscuring customer impact or recovery. (after van Gogh)

Design around risk and real responsibilities

Build the programme around this understanding of work, rather than a catalogue of modules. Discuss important workflows with their owners, review incident and support information using only the data needed, and ask colleagues where secure working is difficult. Distinguish a knowledge gap from a missing tool, contradictory instruction or excessive workload. NIST recommends a continuing learning lifecycle, while the ICO calls for regular assessment of different staff groups’ needs (Merritt et al., 2024). Neither prescribes a universal syllabus to buy unchanged.

Select a small number of behaviours linked to material tasks. Define the situation, the intended action, the enabling control and the owner. For payment-detail changes, the finance owner might require independent verification through an approved contact route, supported by a maintained supplier record and separation of approval responsibilities. A proportionate measure would examine whether sampled changes followed the process and what exceptions occurred. It would not infer the amount of fraud prevented from attendance at a finance briefing.

A five-station walkway connects a supplier-change request with verification, ownership, supporting records and review evidence
Define the action, its owner, the supporting control and the evidence needed to review it (after Escher)

Tailor by task, access and decision, not by stereotype

A common foundation can cover help-seeking, reporting, protecting access and handling information. Beyond that, relevance should follow responsibilities. Finance teams need practice with payment verification and exception handling. HR teams need scenarios about recruitment information, authorised disclosure and secure collaboration. Customer-facing teams need clear routes for unusual requests and account-related concerns. In each case, use the approved workflow and non-sensitive practice material rather than expecting staff to invent a response from general advice.

IT administrators, service-desk staff and developers require learning related to the powers they exercise. Examples include following authorised identity-verification procedures, using privileged access, special authorisation to perform restricted operations, correctly, reviewing configuration changes to system settings or escalating a suspected exposed authentication secret, a confidential value used to verify identity, through the approved route. Their managers should arrange safe practice environments and competent support. Executives need a different emphasis: assessing risk information, approving resources, challenging exceptions and making decisions during disruption. An executive tabletop, a discussion-based exercise, should test authority and coordination, not recall of technical terminology.

For procurement teams, the objective may be recognising when a supplier needs security and privacy review, identifying the reviewer and allowing time before commitment. Operational teams may need to practise an approved escalation or continuity procedure for sustaining business processes during disruption, without attempting unauthorised technical fixes. These examples illustrate programme design; they do not establish a particular reduction in losses. Pilot them against the actual work and change any process that obstructs the intended action.

Equally sized workstations use different task objects and practice tools above a shared learning foundation.
Tailor learning to the responsibilities people exercise, not assumptions about who they are (after Gauguin)

Build learning into joining, moving and leaving

Sequence onboarding so people receive essential instructions before undertaking the relevant task, with role-specific practice following when the tools and context are available. A joiner should know how to obtain approved access, ask for help and report a concern, not merely where the policy library sits. When somebody changes role, reassess both access and learning needs. When a service or procedure changes, update the job aid and provide targeted practice rather than waiting for the next annual campaign.

Include contractors, volunteers and temporary colleagues according to their work and access; the ICO explicitly includes these groups in its training-needs guidance. Agree responsibilities with their employer or service provider, but do not assume generic external training explains your reporting arrangements. At departure or contract end, the manager and IT owner should coordinate access removal, information handover and equipment return. Learning supports these steps; it does not carry them out. Use existing workforce processes to keep coverage current rather than creating a separate register that may fall out of date.

Three doorways show approved access and help at joining, updated learning at a role change, and return and handover at departure
Keep learning, access and handovers aligned as responsibilities change (after Van Gogh)

Deliver learning that people can use

Once priorities are clear, plan explanation, practice, reinforcement and access to help. Allocate working time rather than adding learning to an unchanged workload. Use realistic scenarios that follow approved processes, with personal, client and commercially sensitive details removed. Ask participants where the exercise differs from their job. Their answers may reveal an unresolved process exception rather than a learning gap.

Design accessibility into the materials and platform. Provide clear text equivalents for visual explanations, captions or transcripts for audio and video, readable layouts and meaningful navigation. Do not rely on colour alone, unnecessarily timed tasks or a particular input device. Offer an equivalent route where someone cannot use the standard format, and test delivery with a varied pilot group. HR and learning teams should handle requests for adjustments through appropriate confidential channels; the security dashboard does not need personal explanations for those requests.

Remote and hybrid delivery needs the same practical checks. Can contractors reach the platform? Does reporting work on supported mobile devices, and can colleagues obtain help across shifts? Provide approved guidance for shared spaces, paper records and equipment used away from the office. If learning requires a personal phone or private subscription, offer a suitable alternative. Home working should not become a reason to collect unnecessary information about someone’s household.

Reinforce learning when it becomes relevant: a new collaboration tool, revised disclosure process, role change or recurring service-desk question. A short team discussion or updated job aid may be enough. Avoid reminders so frequent that they compete with one another. The evidence cited here does not establish a universal schedule; choose intervals according to risk, task frequency, feedback and capacity, then reassess them. Give recurring communications an owner and a reason to continue.

Several clear paths connect text, media, practice and help resources to the same accessible learning workspace
Make explanation, practice and help usable through equivalent routes (after Munch)

Use simulations only where their purpose is clear

Simulations are optional, not a prerequisite for a credible programme. Start with supported practice or tabletop discussion where these can answer the learning question. If a simulation is proposed, obtain appropriate authorisation, consult security, HR and privacy specialists, define safe boundaries and prepare response capacity. Explain the programme’s purpose and data use without disclosing individual exercise timing. Avoid distressing themes, collection of real credentials, records binding an identity to a means of authentication, or real passwords and verification codes, public exposure of individuals or exercises whose apparent success depends on misleading colleagues about sensitive employment matters.

Research does not support a simple promise that repeated simulated phishing builds lasting resilience. In a 15-month field study involving more than 14,000 employees at one company, Lain et al. (2022) found that the embedded training tested did not improve phishing resilience and could have adverse effects. The study also identified operational value in collective reporting. These findings concern one company and particular interventions; they do not show that all training is ineffective. They do show why platform activity should not be treated as proof of the intended outcome.

The later study adds an important qualification. In another partner-company setting, Lain et al. (2024) attributed the observed benefit of embedded phishing exercises to their reminder effect rather than consumption of training content. Delaying training was as effective as immediate delivery in that setting. Neither study establishes effects across all cyber-security education or demonstrates reduced real-world losses. Read together, they support examining how an intervention works and under what conditions, not treating either favourable or unfavourable findings as universal.

A rehearsal room and discussion table offer alternative learning methods, with safeguards placed before the rehearsal-room entrance
Choose simulations only when the learning question and safeguards justify them (after Magritte)

Measure capability and organisational response responsibly

That distinction should guide measurement. Decide what evidence would change a decision before collecting it. Completion records establish reach, not competence. Knowledge checks show understanding of the questions asked; exercises show performance under defined conditions, not enduring behaviour in every situation. Incident and loss figures also reflect exposure, reporting, detection, technical controls and other changes. NIST recommends evaluation throughout the learning lifecycle; ENISA cautions against relying on single measures and self-reports (ENISA, 2018; Merritt et al., 2024).

Combine a few indicators for each priority behaviour. Record participation and check separately whether relevant groups could access and use the learning. Interpret supported-task results in light of the assistance provided. Use aggregate workflow evidence to examine practice, feedback to identify obstacles and response information to assess what happens after a report. For supplier-payment changes, pair learning coverage with a proportionate review of verification records and unresolved exceptions. Check whether the independent contact route worked, not just whether participants answered a quiz correctly.

Define what each measure counts. Reporting rates need a stated population and a clear account of the reporting opportunities included; response times need agreed start and end points. Separate service availability from learner capability. More reports could reflect greater willingness to ask for help, increased exposure or an exercise generating additional activity. Fewer reports do not automatically indicate improvement. Preserve these alternative explanations and identify what further evidence would distinguish them.

Simulation comparisons require particular caution. NIST’s Phish Scale was developed to assess an email’s human detection difficulty and provide context for exercise results (Dawkins & Jacobs, 2023). Different messages, audiences and working circumstances make raw click-rate comparisons misleading. Here, click rate means the proportion of recipients recorded as clicking an exercise link; each report should specify its denominator and counting rules. A lower rate is not automatically evidence that learning worked, still less proof of fewer future breaches. Record changes in scenario difficulty, technical filtering and participant coverage. Where several interventions occur together, describe the combined change rather than attributing the result solely to training.

Measurement also brings responsibilities for personal data wherever people are identified or identifiable, including indirectly. Define the purpose, lawful basis, the legal ground permitting the processing, access and retentionarrangements, and explain how the data will be used. Before collection, assess whether a data protection impact assessment (DPIA), a process for identifying and reducing data-protection risks, is needed. A DPIA is required before processing likely to result in a high risk to individuals’ rights and freedoms (UK GDPR, 2016, arts. 4(1), 5–6, 13–14, 35(1)). The ICO’s worker-monitoring guidance addresses necessity, fairness, transparency and proportionality; its relevant guidance is currently marked as under review (ICO, n.d.-b, n.d.-c). Prefer aggregate reporting and suppress or combine small groups where individuals could be inferred, recognising that aggregation alone does not guarantee anonymity. Do not repurpose learning data into covert productivity monitoring or publish individual risk rankings.

Bounded geometric compartments represent limited collection, transparent use, controlled access and retention, with small groups screened from view
Collect evidence to improve the programme, with proportionate safeguards for the people behind the data (after Mondriaan)

End the sponsor’s review with a decision: continue, adapt, stop or investigate. Record what changed, what remains uncertain and who owns the next improvement. Avoid composite culture scores with unexplained weightings. A candid account of gaps in coverage or reporting is more useful than an unqualified green status. Evaluation should help the organisation learn, including when an intervention disappoints.

Five equal evidence panels sit beside four review-decision tokens, without a hierarchy or implied causal chain
Combine evidence, preserve uncertainty and end the review with a decision (after Picasso)

Buy only what the programme needs

Once the learning and evaluation needs are clear, decide what support to buy. A smaller organisation may not need a dedicated platform: a responsible manager, current guidance, a reliable support route, scheduled practice and a modest record of actions can provide a workable starting point. The government’s training collection identifies free NCSC resources for staff, boards and incident-response exercises, including Top Tips for Staff, Cyber Governance Training and Exercise in a Box (Department for Science, Innovation and Technology [DSIT], 2025). These resources do not replace local instructions or establish that every applicable obligation has been met.

Where external support is justified, procure against defined needs. Ask the provider to demonstrate role relevance, accessible delivery, content maintenance and integration with your reporting arrangements. Establish who can see learner data, how long it is retained, what subcontractors are involved and how records can be exported or deleted. Check which claims come from independent research and which derive from the provider’s customers or proprietary scoring. A testimonial or aggregate benchmark does not establish that the proposed service will improve your outcomes.

Budget for internal work as well as the purchase: adapting content, supporting adjustments, handling reports, maintaining integrations and interpreting results. Pilot before making a long commitment and agree when to stop or change course. If nobody can act on the information collected, reduce the scope. For a resource-constrained team, improving one reporting process and practising one important workflow may be more credible than an organisation-wide simulation programme.

A modest toolkit is assessed against a proposed additional component, with supporting objects for access, data handling and maintenance
Buy support for a defined need, including the capacity to act on what it provides (after Dali)

A practical 90-day roadmap

Turn these choices into a manageable first cycle. This 90-day roadmap is a recommended sequence, not a promise of cultural transformation within three months. A small service business might pilot one workflow; a larger organisation might select a few functions before expanding. Keep technical fixes and learning actions together, rather than repeatedly teaching people to work around unresolved design problems.

Days 1–30: establish sponsorship, baseline and priorities

The executive sponsor appoints a programme owner and brings together colleagues responsible for the relevant business processes, HR, learning, IT and privacy. Review important workflows and controls, listen to a representative range of colleagues and test reporting. Choose two or three priority behaviours, or one where capacity is limited, and record each process owner, enabling control and proportionate measure. Establish a baseline using information already legitimately available, noting gaps and uncertainty. Before collecting new information, agree the pilot’s boundaries, protected learning time and data-handling arrangements.

Days 31–60: pilot relevant learning and repair reporting

The learning lead and workflow owner deliver a pilot combining explanation, supported practice and a concise job aid. Include relevant contractor and shift-working arrangements, not only readily available office staff. IT or the service provider resolves access and reporting problems; the response owner confirms capacity to handle reports. Gather feedback on relevance, accessibility and practical obstacles, then tell participants what changed. Expand only when people can complete the exercise through the real process and support arrangements can handle the expected demand.

Days 61–90: review evidence and agree the next cycle

The programme owner and sponsor review aggregate coverage, capability demonstrated under the exercise conditions, workflow evidence and feedback. Note changes in controls or working conditions that complicate interpretation. Decide which obstacles require technical fixes, management action or further learning. Assign owners and dates, retire unhelpful material and agree the next priorities. Report limitations alongside progress. A small team may need only a short review and maintained action log; a larger organisation may require a formal governance paper, with the same discipline.

Before closing the cycle, assign responsibility for keeping each resource current as roles, systems, risks and requirements change. The aim is a functioning process for learning and improvement, not simply a completed launch. Narrow or pause activities with unresolved support or privacy arrangements rather than approving an unrestricted rollout.

Three connected terraces show establishing priorities, piloting and repairing, then reviewing and renewing, with gates before expansion
Use the first 90 days to establish an improvement cycle, not declare cultural transformation (after Escher)

Make secure working a supported organisational practice

A cyber-aware culture is not demonstrated by message volumes or module completions alone. It rests on clear responsibilities, usable controls, relevant learning, accessible help and a constructive response when something goes wrong. Awareness, education and training contribute different capabilities within that system; none can carry the burden alone.

Start with one important workflow. Identify the behaviour it requires, ask the people doing the work what gets in the way and give an accountable owner authority to improve both the process and its supporting learning. Review several forms of evidence, acknowledge uncertainty and act on the findings. The next step is not simply another campaign asking people to be careful, but a practical improvement to the conditions in which they work.

Practical principles for leaders

Taken together, the evidence and guidance in this section support a disciplined set of practical principles. Design interventions around consequential behaviours rather than broad awareness topics. Examine systems and incentives before asking people to compensate for design weaknesses. Protect prompt, honest reporting through a proportionate just-culture standard. Use nudges selectively at genuine decision points and remove those that do not produce useful evidence. Reinforce useful behaviour specifically, space learning, make it role-relevant and test whether practice transfers beyond an exercise. Use trusted communities to generate implementation ideas, while distinguishing practitioner experience from rigorous evidence. Select events and tools against defined capability gaps, protect employee privacy and publish what the programme has learned, including where an intervention did not work as expected.

Above all, cyber culture should be managed as an organisational capability rather than a short-lived campaign. Management responses, repeated decisions and continuing evaluation can shape whether people trust reporting routes, practise secure behaviour and learn from experience. A well-designed programme does not ask employees to carry unlimited responsibility for technical risk. It combines clear expectations, usable controls, timely help, permission to pause and a reporting process that employees can use with confidence. These conditions can help the organisation anticipate, detect and learn from mistakes, but their effect should be evaluated rather than assumed.

Cyber-Aware Culture FAQ
Cyber-Aware Culture Myth-Buster
Get in Touch

Further reading and authoritative guidance

For authoritative guidance, senior leaders can use the NCSC’s 10 Steps to Cyber Security to support risk management, the NCSC’s phishing guidance to develop layered organisational defences, ENISA’s behavioural guidance on cybersecurity culture to inform awareness design, NIST SP 800-50 Rev. 1 to build and evaluate a learning programme, and the NIST Cybersecurity Framework 2.0 to connect awareness with wider risk governance.

References

The sources below provide full publication details for the principal authoritative guidance used throughout the article. Inline links direct readers to the specific pages supporting individual claims and examples.

Comments

Leave a Reply

❚

Latest posts