Is Traditional Training Enough in Today’s New Understanding of Learning?

Cybersecurity Awareness Training: Measuring Risk and Impact

A Changing World

In today’s business landscape, risk is a constant presence. Whether it stems from economic factors, geopolitical tensions, or cyber threats, understanding and managing risk is crucial. Businesses have three primary ways to address risk: accepting it, mitigating it, or transferring it to a third party through insurance. To determine the appropriate course of action, organizations must find a way to quantify risk, particularly in economic terms.

The cybersecurity industry is witnessing a significant shift in how risk is measured and articulated. Increasingly sophisticated methods enable executives across various departments to understand the economic risks associated with cyber threats. This change is transforming cybersecurity awareness training from a mere checkbox item for the cybersecurity team into a strategic priority addressed by corporate leadership and the board.

Moving Goalposts

This changing understanding of risk also impacts how cybersecurity awareness training is purchased and evaluated. Traditionally, cybersecurity training followed a “training” model, with emphasis on teaching trainees and measuring success based on knowledge retention over time. Assessments were typically conducted through tests or quizzes, comparing pre-training scores with post-training scores.

However, as the industry evolves, cybersecurity awareness training is increasingly recognized as a risk mitigator. The focus shifts to employee behavior, independent of the specific learning processes leading to behavioral change. Pre-training measurement involves simulated threats, evaluating employees’ responses against best-practice behavior.

While training may still be delivered in a traditional lesson format, assessment takes the form of additional simulations and behavioral measurements. If post-training behavior does not align with best practices, reinforcement is provided at the time and in the context of the observed mistake. This approach ensures that employees are in a constant state of training and behavior reinforcement, integrating training into their daily work rather than treating it as a separate activity.

Better Behavior for Lower Risk

Reducing risk through cybersecurity awareness training has direct implications for cyber insurance. Companies that effectively mitigate risk through training can expect lower insurance premiums, making it a process that contributes to the organization’s bottom line rather than a mere expenditure.

The convergence of risk quantification, cybersecurity awareness training, and cyber insurance is a topic of interest in Omdia’s Enterprise Security Management practice. By adopting modern learning techniques and educational approaches, organizations can transform training into behavior modification. This approach is spurred by the growing understanding that risk reduction hinges on employee behavior, rather than solely on knowledge retention.

Conclusion

As the significance of measuring risk and training impact increases, organizations must adapt their approach to cybersecurity awareness training. By embracing a risk-oriented mindset and focusing on behavior modification, businesses can turn this training into a strategic tool for minimizing cyber threats. As cyber insurers seek to lower claim payouts, demonstrating effective risk mitigation through training becomes increasingly important. It is essential for organizations to stay up to date with the evolving cybersecurity landscape and incorporate modern learning techniques to ensure employees are continuously trained and motivated to adhere to best practices.