Organisations expanding cybersecurity training to include customers

Issue 8 2022 Training & Education

Enterprise organisations are taking security awareness to the next level. Knowing that even the best technology can only successfully repel a potential cyberattack 90-93% of the time, it is now a mandate of many companies to give employees the training and education they need to prevent them from clicking on something they should not.

Having seen remarkable success in behavioural-based cyber training programs, many are also looking beyond their digital perimeter and providing similar education to members and customers.

These new methodologies are capable of drastically reducing human error-related breaches, using an approach that involves understanding the psychology of each learner and providing training to which they can relate.

This is particularly important as phishing, and other scams, grow in sophistication. Organisations are increasingly looking to customers and members as partners in the pursuit of reducing attacks, which have exploded globally into more than 6 trillion dollars in losses annually.

Human behaviour as a strength

For a long time, the human factor has generally been spoken of as a ‘weakness’ or ‘vulnerability’ in the defence of an organisation’s network, but some are beginning to frame it differently.

“I think humans can be a great strength in cybersecurity,” explains Kin Lee-Yow, chief information officer of the CAA Club Group (CCG), the largest automobile club in Canada. “And a strong cybersecurity defence is crucial, not just on an enterprise level, but for people at every level.”

CCG, which admittedly is ‘obsessed’ with the safety of its more than 2.5 million members, discovered that many of them do not know where to turn when it comes to learning about online safety. According to a study they conducted, 62% of members know someone, or have personally, experienced a privacy or data security breach. One-third, personally experiencing a breach, thought it could have been avoided with better awareness and education.

“If everybody were more knowledgeable and better trained on what to look for from these cyberattacks, then I think overall, the hackers would have less success, and that would probably discourage at least some of the activity,” says Lee-Yow.

A new psychology

In an effort to foster a security-aware culture among employees, there has been a shift in thinking. Instead of using generic, one-size-fits-all lessons, the new method focuses on educating the right person at the right time in the right way to instigate change in behaviour.

“The first step in the CyberconIQ training we use is to understand your personality profile,” explains Lee-Yow. “Do you tend to follow rules or are you maybe a little bit of a risk taker? Everyone is going to be vulnerable in different ways. So, the training has to match up with that.”

CyberconIQ was one of the first companies to merge psychology, cybersecurity, and machine learning to develop a customised approach for each employee. By providing awareness of key motivating factors that drive underlying online employee behaviour, companies can greatly reduce the chances of someone falling for a scam and compromising the network.

“I think these companies are beginning to understand that if they have members or clients, they have at least some responsibility to help protect them as well,” says Jessica Gutierrez, director of learning design and development at CyberconIQ.

The paradox of enterprise security

Large corporations and financial institutions are both the most secure as well as the most vulnerable to a cybersecurity attack. This can be explained by the fact that these organisations typically deploy the latest security technology to protect their perimeter, yet are only as secure as their least-aware employee is.

Of particular danger are the increased instances of phishing, which the 2022 IBM X-Force Threat Intelligence Index noted makes up 41% of all attacks. With the 7-10% gap in one’s firewall that technology simply cannot close, there is a 100% statistical probability that every employee will eventually come across some form of novel threat – be it in an email, chat, or weblink. They will need to identify it as such and know how to best deal with it.

Ultimate goal: raise the bar

The inclusion of customers in an awareness programme has additional advantages. For example, it can protect or even improve a company’s reputation. It can also prevent the business from attack by a third party with lax security. The notorious Target security breach of 2013 occurred when a vendor fell for a phishing email; the thieves were able to access Target’s network through the vendor’s account.

“Our members told us they wanted help in better understanding cybersecurity,” remarked Lee-Yow. “We felt we could fill this gap by offering relevant and timely training.”

This is part of a strategy to combat phishing and hacking on a larger scale; the hope is to thwart attacks by making as many people as possible aware of bad habits by educating them in a way that actually changes behaviour.

“The fewer people that are susceptible to cybercriminals, the better for all of us,” Gutierrez concluded.

Find out more at

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Tips and tools for trade businesses
News & Events Training & Education
ServCraft brings together trade industry associations and corporations to launch blox, a digital content platform and community impacting lives, businesses and industries across hundreds of thousands of trade business SMEs.

Africa Online Safety Platform launched in SA
Training & Education News & Events
Impact Amplifier, with the financial support of, launched its African Online Safety Platform (AOSP), a platform providing a rich repository of research, education content, funding opportunities and ways to seek help after an online crime.

South African Keiron PRO laser target system
News & Events Training & Education
Jacstech, based in Cape Town, South Africa, has been appointed to supply a complete Keiron PRO laser training system to the SIRT Academy. The SIRT Academy is a firearms and tactics training facility in Perugia, Italy.

Practical guide to protect data privacy
Training & Education Information Security
The Data Privacy Toolkit, reflecting the evolving landscape of data privacy, includes guidelines and recommendations to safeguard sensitive information crucial for protecting sensitive information from malicious actors.

ONVIF releases first add-on for secure communications
Surveillance Training & Education
ONVIF has released the final version of the TLS Configuration add-on to increase the security of communications between devices and software clients within a physical security system.

Mastering security awareness in the digital era
Security Services & Risk Management Training & Education
Human error and lack of security awareness remain the first security threat. Companies must consider the importance of managing employee cyber risk and the significance of training and awareness programmes.

Preparing young entrepreneurs
News & Events Training & Education
Liquid Intelligent Technologies SA recently announced that its Youth Empowerment Programme is successfully preparing young South Africans with the skills they need to succeed in a digital future.

Free South Africa Market Report webinar from TAPA EMEA
Technews Publishing Editor's Choice News & Events Transport (Industry) Training & Education Logistics (Industry)
October 2023 offers TAPA EMEA members and non-members opportunities to increase their knowledge of cargo crime and supply chain security risks in three countries in Europe, the Middle East & Africa region, where supply chains are most targeted by both organised crime groups and other offenders.

Empowering the new team of trailblazers in cybersecurity
News & Events Information Security Training & Education
Fortinet is committed to creating more opportunities for women in cybersecurity in South Africa as it actively fosters a culture of inclusion by expanding access to training and career advancement through its training institute.

Digital transformation is dependent on engaged leaders
Training & Education Infrastructure
Having a digitisation strategy in place is the starting point, but to truly activate a digital transformation programme, organisations need a strong leadership team that has acute self- awareness, and can positively contribute and direct their influence toward the people affected by change.