An employee clicks on a suspicious link, realises something is wrong and decides not to tell anyone. They might be embarrassed or worried about getting into trouble. Meanwhile, the security team has no idea that something may have happened, losing valuable time to investigate and respond.
According to Jason Oehley, Regional Sales Director at Arctic Wolf, this is exactly the kind of situation businesses should be thinking about during Cybersecurity Awareness Month. Organisations invest in training employees to recognise cyber threats, but the way they respond when someone makes a mistake can have serious implications for their security.
“We see that quite a bit,” he says, referring to organisations that take what he calls a “big stick approach” to cybersecurity mistakes. “If somebody is scared to report something because they’ve done something wrong, they’re not going to.”
With cybercriminals finding new ways to catch people out, that reluctance to speak up can become a serious vulnerability.
When knowing the risks isn’t enough
Phishing and social engineering are hardly new, but the volume of suspicious communications people encounter has increased significantly. AI has made it easier to create phishing campaigns, while employees are dealing with messages and phone calls designed to catch them at the wrong moment.
Oehley believes the demands of everyday working life are an important part of the problem. Attackers rely on people having their minds elsewhere, making it easy to click on something without giving it much thought.
A message about an outstanding traffic fine might create enough concern for someone to respond without checking its legitimacy. A fraudulent email address might contain a tiny spelling difference that is almost impossible to notice at a glance.
Even people who understand cybersecurity can make mistakes. “Anyone can get caught out. Years ago, I got caught out. I know other people in security who get caught out,” explains Oehley, adding that senior executives are equally susceptible.
The problem with punishing mistakes
Organisations understandably want employees to take cybersecurity seriously. However, Oehley questions approaches that focus on catching people doing something wrong rather than helping them recognise and report potential threats.
He describes organisations where employees are discouraged from warning colleagues about suspicious emails because the messages form part of a phishing simulation. The intention is to test who clicks, but Oehley believes there is value in encouraging employees to alert one another.
“Why not rather go and tell them, ‘Guys, I think this is a phishing email. What do you think?'”
The same principle applies when someone has already clicked a malicious link. An employee who expects to be reprimanded may hesitate to tell IT, particularly if they’re unsure whether anything has happened.
“Most people don’t intentionally do things to harm a business. Sometimes they’re simply just too busy to notice.”
He believes organisations should create an environment where employees feel comfortable raising concerns. They need to understand the seriousness of a potential incident while knowing that reporting it is the right thing to do.
Security culture starts with leadership
Leadership has an important role in establishing that environment. Approving cybersecurity budgets and policies is part of the responsibility, but executives also need to demonstrate the behaviours they expect from employees.
Oehley argues that leaders should actively support security awareness and reinforce the message that protecting the business is everyone’s responsibility.
Many businesses still rely on annual or monthly awareness exercises, which he believes are insufficient to create lasting behavioural change. He advocates regular reinforcement, with engaging content that reflects the threats employees are encountering.
He also encourages organisations to make learning a positive experience. Recognising employees who participate and rewarding progress can help keep cybersecurity visible throughout the year.
Are businesses measuring the right things?
Training completion rates may demonstrate that employees have fulfilled a requirement, but they don’t necessarily show whether an organisation has developed a healthy security culture.
Oehley believes businesses should track improvements in phishing simulation results and consider how awareness initiatives contribute to their overall security posture.
They should also be asking whether employees feel comfortable raising concerns and whether they know what to do when something goes wrong. An organisation where people warn one another about suspicious communications is already demonstrating the kind of behaviour that training should encourage.
Cybersecurity awareness must also form part of a proactive security strategy because employees cannot be expected to identify every threat.
For Oehley, the starting point is creating a positive experience in which people learn from one another and understand the role they play in protecting the business.
“Be part of the solution, not the problem,” he says. “Practise it yourself, share the experience.”
When an employee realises they may have made a cybersecurity mistake, the business needs them to feel comfortable saying something. Because, as Oehley puts it, “Security’s a team effort.”