Security awareness month: skip the posters
October is awareness month. Instead of posters and a quiz, do three things that change how people act.
October is cybersecurity awareness month in many countries, and it usually means posters, a quiz and a phishing test that embarrasses people. Little of it changes behaviour.
Three things that do:
- Make reporting easy and welcome. One button in the mail app, and a thank-you reply every time, even for false alarms. People report more when they’re thanked, not judged.
- Show real examples from this year: the fake CAPTCHA that asks you to paste a command, the “IT support” call asking to approve a login, the invoice with new bank details. Fifteen minutes, with screenshots.
- Fix one thing for everyone: turn on passkeys, roll out the password manager, or remove admin rights. Training works better when the safe way is also the easy way.
Then ask staff what slows them down in security. Their answers are usually worth more than the quiz results.