Cybersecurity 101 Training: How to build employee habits that prevent cyberattacks

One of the reasons why cyber attacks that exploit our basic nature, such as our trust or curiosity, succeed is because individuals often lack the motivation to undergo continued training.⁹ What’s more, an estimated 85% of cyber attacks across the globe are successful not because bad actors hack code, but because they hack our core human behaviors.^{10, 11}

Research shows that behavior change rarely happens just because we’ve been exposed to a particular message; that message also has to be delivered at the right moment — specifically, one where we have the time, energy, and motivation to properly absorb and reflect on it. This idea encapsulates the elaboration likelihood model, which suggests that our ability to be persuaded on a topic depends on how invested we are in the topic.¹² Onboarding is an ideal opportunity to capitalize upon a new employee’s excitement for the position and their desire to build a positive reputation within the company, as well as the fact that they’re not yet bogged down by other work and are more likely to have the resources to deeply process the information they’re receiving.

While only you understand the cultural nuances and cybersecurity needs of your organization, there are a few empirically proven suggestions that you can consider when discussing changes to onboarding procedures with colleagues. 

1. Reinforce cybersecurity expectations from the start

How to do it: It is essential to create a high-trust environment from an employee’s first day by defining their role within the organization.¹³ This helps employees understand the context in which they will work, and gives them an idea of who to turn to in case they receive a phishing email or are hacked. During the onboarding process, provide the employee with a walkthrough of expectations, not just job-related but security-related, too. Make it clear that the employee has been chosen for a reason and why they belong at the organization.

Why it works: When trying to reinforce cybersecurity expectations among more tenured employees, leadership has to consider the role of habits in their employees’ daily lives. Habits can be extremely hard to break,⁶ even when they know to do better.¹⁴ By contrast, new employees have more of a blank slate and are not yet influenced by social norms which can shape how people act (and maintain cybersecurity) within a group.¹⁵

The impact: In understanding how important they and their cyber practices are to the organization, employees will value their privacy choices more highly, which can help prevent the type of negligent behavior exploited by hackers.¹⁶ When they feel valued in their team and employer, they are also more likely to report suspicious activity and go beyond minimum cybersecurity recommendations.⁷

2. Practice effective communication about risk 

How to do it: Firms run into various issues when communicating risk. They might communicate too frequently (leading to notification fatigue and employees who tune out the messaging) or not frequently enough (leading to employee perceptions of ineptitude, or the belief that the firm values its own reputation over employee protection).¹⁷
One effective communication strategy is the Extended Parallel Process Model (EPPM), in which threat messages are balanced with messages about self-sufficiency and empowerment.¹⁸ Moreover, be mindful when presenting statistics: while it may attract the attention of some, others with lower numeracy fluency may dismiss the message.¹⁹

Why it works: By including behavioral recommendations next to fear-inducing text, CISOs and managers can encourage their teams to take steps for self-protection, rather than simply panic or ignore the message.¹⁸ By including specific recommendations, a firm can empower employees to help themselves and take action when something goes wrong.¹⁸

The impact: All too often, employees receive communications either during onboarding or throughout their tenure, with varying levels of effectiveness. Poorly communicated messages can lead employees to adopt a careless attitude towards security.¹⁹ Through strategic wording and timing, leadership can encourage the results they want to see and ensure better cybersecurity measures among employees.

Even though Human Resource professionals typically run onboarding sessions, an even better solution would be to work closely with your company’s Behavioral Insights team and capitalize on their familiarity with the behavioral fallacies outlined in this article. If you’re looking to launch a Behavioral Insights team within your organization, but you’re not sure where to start, get in touch with us — we’ve helped some of the world’s largest companies introduce behavioral insights into their work by building “Nudge Units” tailored to their unique culture and goals.

Behavior change isn’t just about what you say to people; it’s also about when you have that conversation. By focusing on initial training, the likelihood of negligence-related cyber attacks can be greatly reduced, with the additional benefit of giving employees a greater sense of belonging and responsibility.

There is a broad range of behavioral fallacies that we encounter in cybersecurity preparedness. In their webinar, Strengthen Your Strategy with Cybersecurity, The Decision Lab and Boston Consulting Group discuss two hypothetical scenarios that highlight different levels of readiness and the psychology behind each.

The Decision Lab is a research-oriented consultancy that uses behavioral science to advance social good. We work with some of the largest organizations in the world to spark change and tackle tough societal problems. We’re advised by some of the most innovative minds in cybersecurity, a growing issue in the new WFH landscape. If you'd like to tackle this together, contact us.