The ‘not me’ issue in cybersecurity
New global research from Mindtools Kineo finds that while 84% of employees are aware of cybersecurity risks, 55% doubt that their workplace internet activity could expose confidential information. And 24% believe cybersecurity incidents are more likely to happen in other parts of the organization.
Although cybersecurity training is a familiar part of organizational life, knowing what to do isn't necessarily the same as doing it.
So, what really influences whether employees make secure decisions in their everyday working lives? And how can organizations move beyond awareness training to build lasting security behaviours?
A new research report from Mindtools Kineo, Cybersecurity’s Tipping Point: What makes people act securely, or not at all, explores these questions, examining the human factors that influence cybersecurity behaviour and the role organizations can play in changing it.
Drawing on research with 296 participants across 33 countries, the report highlights how people's perception of personal risk, confidence, stress and fear can all influence their responses to cybersecurity threats. It also explores the impact of managers, organizational culture and psychological safety on the choices employees make.
The opportunity for L&D
The findings have important implications for learning and development teams. Traditional approaches that focus primarily on communicating policies and raising awareness may not be enough to translate knowledge into action.
Instead, organizations need to consider how they build confidence, create supportive environments and give people opportunities to practise responding to real-world situations. Continuous, practice-based learning can help employees develop the skills and confidence to make more secure decisions, even as emerging technologies and AI introduce new and evolving risks. Managers have a key role too: creating teams where people can admit mistakes without fear of blame and keeping stress in check.
Dr Anastasia Voronkova, Insights Analyst at Mindtools Kineo, said:
‘Most employees know a cyber incident could be serious – they just don’t think it will happen to them. And when people do feel at risk but don’t feel equipped to respond, or are too stretched to think clearly, the result is often paralysis rather than action. If we want people to behave more securely, we need to move beyond awareness and give them the confidence, support and opportunities to put their knowledge into practice.’
The report offers valuable insights for L&D professionals, cybersecurity leaders and anyone responsible for building organizational capability and creating a culture where secure behaviours become part of everyday working life.
Download your free copy of the report here.