Organisations expanding cybersecurity training to include customers

Issue 8 2022 Training & Education

Enterprise organisations are taking security awareness to the next level. Knowing that even the best technology can only successfully repel a potential cyberattack 90-93% of the time, it is now a mandate of many companies to give employees the training and education they need to prevent them from clicking on something they should not.

Having seen remarkable success in behavioural-based cyber training programs, many are also looking beyond their digital perimeter and providing similar education to members and customers.

These new methodologies are capable of drastically reducing human error-related breaches, using an approach that involves understanding the psychology of each learner and providing training to which they can relate.

This is particularly important as phishing, and other scams, grow in sophistication. Organisations are increasingly looking to customers and members as partners in the pursuit of reducing attacks, which have exploded globally into more than 6 trillion dollars in losses annually.

Human behaviour as a strength

For a long time, the human factor has generally been spoken of as a ‘weakness’ or ‘vulnerability’ in the defence of an organisation’s network, but some are beginning to frame it differently.

“I think humans can be a great strength in cybersecurity,” explains Kin Lee-Yow, chief information officer of the CAA Club Group (CCG), the largest automobile club in Canada. “And a strong cybersecurity defence is crucial, not just on an enterprise level, but for people at every level.”

CCG, which admittedly is ‘obsessed’ with the safety of its more than 2.5 million members, discovered that many of them do not know where to turn when it comes to learning about online safety. According to a study they conducted, 62% of members know someone, or have personally, experienced a privacy or data security breach. One-third, personally experiencing a breach, thought it could have been avoided with better awareness and education.

“If everybody were more knowledgeable and better trained on what to look for from these cyberattacks, then I think overall, the hackers would have less success, and that would probably discourage at least some of the activity,” says Lee-Yow.

A new psychology

In an effort to foster a security-aware culture among employees, there has been a shift in thinking. Instead of using generic, one-size-fits-all lessons, the new method focuses on educating the right person at the right time in the right way to instigate change in behaviour.

“The first step in the CyberconIQ training we use is to understand your personality profile,” explains Lee-Yow. “Do you tend to follow rules or are you maybe a little bit of a risk taker? Everyone is going to be vulnerable in different ways. So, the training has to match up with that.”

CyberconIQ was one of the first companies to merge psychology, cybersecurity, and machine learning to develop a customised approach for each employee. By providing awareness of key motivating factors that drive underlying online employee behaviour, companies can greatly reduce the chances of someone falling for a scam and compromising the network.

“I think these companies are beginning to understand that if they have members or clients, they have at least some responsibility to help protect them as well,” says Jessica Gutierrez, director of learning design and development at CyberconIQ.

The paradox of enterprise security

Large corporations and financial institutions are both the most secure as well as the most vulnerable to a cybersecurity attack. This can be explained by the fact that these organisations typically deploy the latest security technology to protect their perimeter, yet are only as secure as their least-aware employee is.

Of particular danger are the increased instances of phishing, which the 2022 IBM X-Force Threat Intelligence Index noted makes up 41% of all attacks. With the 7-10% gap in one’s firewall that technology simply cannot close, there is a 100% statistical probability that every employee will eventually come across some form of novel threat – be it in an email, chat, or weblink. They will need to identify it as such and know how to best deal with it.

Ultimate goal: raise the bar

The inclusion of customers in an awareness programme has additional advantages. For example, it can protect or even improve a company’s reputation. It can also prevent the business from attack by a third party with lax security. The notorious Target security breach of 2013 occurred when a vendor fell for a phishing email; the thieves were able to access Target’s network through the vendor’s account.

“Our members told us they wanted help in better understanding cybersecurity,” remarked Lee-Yow. “We felt we could fill this gap by offering relevant and timely training.”

This is part of a strategy to combat phishing and hacking on a larger scale; the hope is to thwart attacks by making as many people as possible aware of bad habits by educating them in a way that actually changes behaviour.

“The fewer people that are susceptible to cybercriminals, the better for all of us,” Gutierrez concluded.

Find out more at

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

ALX sponsored learning programmes for 2023
Training & Education News
With a mission to harness Africa's abundant human capital by developing two million ethical and entrepreneurial young leaders from the continent by 2030, ALX has launched four fully sponsored (at no cost) tech programmes for 2023.

Cybersecurity in Africa: The challenges and solutions
Training & Education Cyber Security
Africa faces a significant challenge when it comes to the availability and distribution of cybersecurity talent and secure IT infrastructures. Facing this challenge will require supporting and nurturing the next generation of security graduates and professionals.

Developing an effective CCTV control room culture
Leaderware Editor's Choice CCTV, Surveillance & Remote Monitoring Training & Education
Organisational culture in organisations can be seen as the set of values, practices, focus, standards and behaviours, and ways of interacting with others that are accepted and subscribed to by the people who work there.

Mind the gap
Training & Education
The skills shortage in South Africa is less of a gap and more a gaping chasm, especially when it comes to finding or training and retaining talented people in the security industry.

Olarm launches its academy
Olarm Training & Education
Security professionals need to stay up-to-date with the latest product developments and best practices. Stay ahead in the ever-evolving security industry by accessing free educational resources and comprehensive, flexible and remote training programmes from Olarm.

Abundant scarcity
Training & Education
Organisations are fighting to find and retain skilled security talent; however, the market remains in scarcity, which makes skills development the new priority, says Innocent Baloyi, Consultant: Cloud Security at Altron Karabina.

Managed services can alleviate the skills shortage
Training & Education Security Services & Risk Management
South Africa is in the midst of an ongoing and deepening IT skills shortage exacerbated by the high global demand for IT talent from the country’s skills pool and often spurred on by attractive remuneration and the opportunity to work without leaving home.

Paxton begins Tech Tour in South Africa
Paxton Training & Education Access Control & Identity Management
The Paxton Tech Tour 2023 is free to attend and a chance for installers to develop knowledge and explore business opportunities with Paxton’s products and services. Its South African events start in February and will continue at locations around the country for months.

Unlocking South Africa's digital transformation
Training & Education
There is a cross-functional responsibility between government, the private sector and tertiary education institutions to ensure that South Africa’s youth are prepared to take advantage of the massive employment opportunities in technology.

Crossing the chasm
Editor's Choice News Security Services & Risk Management Training & Education
Industry reports suggest that in the next ten years, millions of jobs could go unfilled because there simply are not enough people to fill them.