Osterman Research
WHITE PAPER

White Paper by Osterman Research
Published September 2020
Sponsored by Infosec, KnowBe4, MediaPRO and Mimecast

Security Awareness Training as a Key
Element in Changing the Security CultureSecurity Awareness Training as a Key Element in Changing the Security Culture

Executive Summary
The goal of any corporate security infrastructure is to protect corporate data, accessto on-premises and cloud-based systems, various types of sensitive information like
login credentials and customer data, and even the physical assets used to manage
networks and endpoints.
The conventional method of accomplishing the objective of securing these assets has
been the deployment of various types of security hardware, software and cloudservices, including firewalls, endpoint detection and response solutions, anti-virus
software, secure email gateways, web application firewalls, and a host of othersolutions. Underscoring just how important this approach has been is the fact that atleast 2,336 vendorsi of these types of solutions currently operate worldwide, withnew entrants joining the market continually.
However, cybersecurity technology can go only so far in protecting an organization.
Because bad actors increasingly target users of corporate systems and services, theseusers must be adequately equipped to deal with a growing variety of threats directed
at them, sometimes specifically at their role within the organization. Consequently,
good security awareness training is essential in protecting the organization fromsecurity threats and the damage they can cause. But the goal of security awarenesstraining should be the development of fundamental change in users – change in theway they think about security – that will translate into the development of a robust
security culture.

KEY TAKEAWAYS

Here are the key takeaways presented in this paper:•

IT, security and business leaders – while generally wanting to establish a strong
cybersecurity culture within their organization – are somehow not conveying thatidea effectively to a large proportion of their employees.

•

Even so, security awareness training is perceived to be as important astechnology in dealing with security threats and organizations will be devoting
more focus to training over the next year. Moreover, the proportion of users who
spend no or very little time in training is expected to fall significantly by mid2021.

•

There is a relationship between the amount of time that employees spend insecurity training and how they see themselves as part of their organization’s
security culture: compared to employees who spend a significant amount of timein security training each month, those who spend little time each month arethree times more likely to view themselves as having little or no role inprotecting their organization from cyberthreats.

•

As users receive more security awareness training, their ability to effectively deal
with security threats increases. The “before-and-after” picture is impressive:
users who are properly trained are much more likely to be able to spot phishingattempts and email compromise than are their untrained colleagues.

•

Users who find security awareness training interesting and engaging derivesignificantly more benefit from the training than do users who find it to be boring
or uninteresting. Moreover, users who spend more time in training and who findit more interesting are much more likely to derive benefits from it outside of theworkplace.

•

Senior IT and business management are much more enthusiastic about security
awareness training than are non-management employees. Similarly, security and
IT leaders, their staff members, and business leaders are largely onboard with
the idea that developing a strong cybersecurity culture is important; other©2020 Osterman Research, Inc.

Securityawarenesstraining isperceived to be
as important astechnology indealing withsecurity
threats.

1

Security Awareness Training as a Key Element in Changing the Security Culture

employees are much less convinced about the importance of doing so, indicatingthat the goal of developing a robust security culture has not yet been achieved inmost organizations.

ABOUT THIS WHITE PAPER

Two surveys were conducted for this white paper: one survey was conducted withindividuals who manage, contribute to or influence their organization’s security
awareness training program, while a second survey was conducted with 1,000
employees in the United States.
This white paper was sponsored by Infosec, KnowBe4 and MediaPRO; information
about each company is provided at the end of the paper.

What are Decision Makers Most
Concerned About?
THE IMPORTANCE OF A SECURITY CULTURE

Why is the development of a security culture matter important, and why is it superior
simply to changing users’ behavior so that they learn to adhere to best practices?
When employees consider it their personal responsibility to adhere to security bestpractices instead of following a checklist of do’s and don’ts, they will:•

Become more sensitive to things like phishing, spearphishing and business email
compromise attempts,•

They will take the extra steps needed to ensure the security of corporate data,•

They will be more compliant with protocols that are not directly related tosecurity, such as protecting customers’ personal data in compliance with statutes
like the General Data Protection Regulation (GDPR) or the California Consumer
Privacy Act (CCPA),•

They will apply what they learn to their personal lives in terms of how they
manage their home Wi-Fi networks, banking access, etc., and•Security will become second-nature to them as opposed to just another workrelated task.

Security culture is about affecting a fundamental change in employees, not simply
adding more rules for them to follow.

THE IMPLICATIONS OF A SECURITY CULTURE

An organization that develops a true culture of security can realize a number ofsignificant benefits:•

Fewer malware intrusions that will save security departments hundreds or
thousands of person-hours each year in detection and remediation work eachyear; not to mention the time saved because employees are not idle while theirworkstation is being reimaged to recover from the attack.

•A significantly reduced likelihood of a ransomware infection that could shut downa business for days or weeks, resulting in the avoidance of hundreds ofthousands or millions of dollars in lost revenue.

•

Reduced strain on a security team that is very likely already overworked, which
could potentially translate into less staff turnover. For example, one study foundthat some organizations’ security operations centers are experiencing in excess
of 50 percent churn each yearii.

©2020 Osterman Research, Inc.

2

Security Awareness Training as a Key Element in Changing the Security Culture•

A greater level of compliance with the growing number of privacy and data
breach regulations, such as the GDPR and the CCPA. Compliance with theseregulations can save an organization enormous sums, since these regulations
carry with them very large fines if security best practices are not followed. In thecase of the GDPR, for example, fines start at the greater of £10 million or two
percent of the previous year’s revenue, whichever is greater.

CONCERNS ABOUT A RANGE OF THREATS

Not surprisingly, decision makers and influencers in IT and security departments
express serious concerns about a wide range of cyberthreats and other types ofcybersecurity issues. As shown in Figure 1, the leading concerns are focused on
threats that are most often delivered through email, such as malware, spearphishingand ransomware. Because email is and continues to be the primary communication,
collaboration and content-sharing tool in most organizations – and will remain so formany years – email-related threats will continue to be a critical security concern for
the indefinite future.
Figure 1
Leading Cybersecurity Concerns

Email-related
threats willcontinue to bea criticalsecurity
concern for theindefinite
future.

Source: Osterman Research, Inc.

What’s particularly interesting about the data in the figure above is that despite thehundreds of billions that have been spent on technology-focused solutions to addresscomparatively simply problems over a period of many years, such as detecting
malware in an email, it remains an issue of significant concern to two-thirds of
security decision makers and influencers.
Awareness training is a core component to a multi-layered, multi-zone email security
strategy that engages people and technology to stop phishing, ransomware, businessemail compromise, and domain impersonation attacks. Using several layers ofenhanced protection that picks up where cybersecurity technology leaves off, the useof a simple-to-use training platform provides the level of protection needed to defend
against ever-growing and evolving cyber threats.
The problem may actually get worse with the growing adoption of Office/Microsoft
365, which is now the dominant business email platform worldwide. For example, an©2020 Osterman Research, Inc.

3

Security Awareness Training as a Key Element in Changing the Security Culture

SE Labs test in 2020 found that the total accuracy rating for Microsoft Office 365
Advanced Threat Protection was just 28 percent, despite the fact that security
solutions in the same test achieved an accuracy rating of 94 percentiii. Osterman
Research has found that a growing proportion of decision makers are opting for the“full meal deal” from Microsoft, rolling out the top-level Office/Microsoft 365 plan
(Plan E5, as of this writing) to their users instead of deploying third-party security
that offers better performance.

LOCKDOWNS ARE RAISING CONCERNSThe COVID-19 pandemic and the associated lockdowns, stay-at-home orders, shelterin-place orders, and the like that rapidly converted an in-office workforce to one
working from home has increased concerns about security. For example, as shown in
Figure 2, 46 percent of decision makers and influencers are “concerned” or“extremely concerned” about hackers exploiting the new work-from-home workforce.
Figure 2
Concerns About Various Issues
Percentage responding “concerned” or “extremely concerned”

Source: Osterman Research, Inc.

Osterman Research anticipates that these problems will get worse before they getbetter, even as (and because) more workers are returning to an office environment,
bringing their potentially compromised laptops, USB sticks and mobile devices back to
corporate networks.

INCREASED USE OF EMAIL IS COMPLICATING THE PROBLEM
As noted above, email is the primary threat vector in most organizations.
Complicating the security problem is that IT and security decision makers andinfluencers anticipated that use of email for key processes would increase during the
pandemic. As shown in Figure 3, 95 percent believed that use of email for
conventional communications would either increase or remain the same during thecrisis, while only five percent believed that email communications would decrease.
Forty-four percent believed that use of email for sending files and documents would
increase and nearly as many believed that the same level of demand for these
services would be required.

©2020 Osterman Research, Inc.

4

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 3
Anticipated Changes in Use of Email Use During the COVID-19 Crisis
Compared to Before the Crisis

Process
Email communications
Sending files/documents
Sending contracts/approvals
Sales activity/contact customers, prospects

Change in Use of Email
More
Same
Less
64%
31%
5%
44%
42%
13%
30%
45%
25%
30%
35%
35%

Source: Osterman Research, Inc.

This makes it clear that email will remain a mainstay of corporate communications
during the pandemic, and that in order for employees to remain productive, corporate
email systems will need to be operate at a very high level – and certainly no lesssecurely than they do under normal circumstances.

SECURITY AND COMPLIANCE ARE SUFFERING

Figure 4 shows that both security and compliance have suffered during the current
work-from-home environment. For example, while 64 percent of organizations agreewith the notion that they were doing an excellent at job maintaining compliance with
their various obligations before the COVID-19 crisis, that level of agreement fell tojust 56 percent shortly after the lockdowns began. Similarly, while 56 percent agreed
that they were doing an excellent job at blocking security threats prior to the
lockdowns, that dropped to just 49 percent. Even under normal circumstances figures
for doing an “excellent” job at compliance and security should not be this low, but the
lockdowns have clearly had an impact on organizations’ ability to deal effectively withboth.
Figure 4
Changes in Compliance and Security Posture Before and During the Current
CrisisPercentage responding “agree” or “strongly agree”
Issue
Before this crisis, we were doing an excellent job at maintaining compliancewith our various compliance obligations
During this crisis, we are doing an excellent job at maintaining compliancewith our various compliance obligations
Before this crisis, we were doing an excellent job at blocking security threats
from impacting our organization
During this crisis, we are doing an excellent job at blocking security threats
from impacting our organization

%
64%
56%

The ultimate
result of good
security
training shouldbe thedevelopment ofa user mindset
akin to “muscle
memory”,
where good
securitypractices
become almost
second-nature.

56%
49%

Source: Osterman Research, Inc.

Changing the IT Security Culture
THE PROGRESSION OF SECURITY AWARENESS TRAINING

Security awareness training should have as its goal moving users from their current
state of security awareness, where they may be inadequately prepared to deal withthreats like phishing attempts or how to exercise “safe” behaviors; to a state wheresecurity becomes so ingrained in the way they use email and other tools that good
security practices become second nature to them, as shown in Figure 5. At a personallevel, the ultimate result of good security training should be the development of auser mindset akin to “muscle memory”, where good security practices become almost©2020 Osterman Research, Inc.

5

Security Awareness Training as a Key Element in Changing the Security Culture

second-nature. At a corporate level, the goal should be the development of a true
security culture.
Figure 5
Security Awareness Training Progression

Source: Osterman Research, Inc.

A good security awareness training program should focus not on just changing users’
behavior, as useful as that it, but rather creating the sort of fundamental change inusers that they will almost instinctively understand how to use any sort ofcommunication tool, deal with any kind of content, know when and when not to open
attachments or click on links in an email, know how they can validate requests, andso forth.

TRAINING IS PERCEIVED TO BE AS IMPORTANT ASTECHNOLOGY, IF NOT MORE SO

As shown in Figure 6, nearly four in five IT/security decision makers and influencers
consider the combination of technology and training to be equally important indealing with security threats. However, when asked about these two approaches
separately, more than half agreed training is the more effective way to minimize
cybersecurity risk. Over the next 12 months, both training and technology are
expected to increase in their perceived importance, although a slightly larger
proportion of those in IT and security will place more emphasis on training.
Figure 6
Importance of Training vs. Technology
Percentage responding “agree” or “strongly agree”

Source: Osterman Research, Inc.

Similarly, the majority of IT/security decision makers and influencers consider thatusers and technology are equally important in dealing with security threats, as shown©2020 Osterman Research, Inc.

6

Security Awareness Training as a Key Element in Changing the Security Culture

in Figure 7. Over the next 12 months, the role of users will increase slightly inimportance as a defense to threats relative to technology.
Figure 7
Views of IT and Security Leadership on Roles of Users vs. Technology
2020 and 2021

Source: Osterman Research, Inc.

TRAINING EFFECTIVENESS INCREASES AS USERS RECEIVE
MORE TRAINING

Good security awareness training results in employees and contractors who are moreaware of security threats and better able to deal with them. Moreover, an increase in
the amount and depth of this training (to a point) results in employees who are evenbetter equipped to deal with a variety of security threats. As shown in Figure 8,
IT/security decision makers and influencers believe that the more training they
provide to their employees, the more effective that training is in helping users to deal
with various kinds of threats.
Figure 8
Effectiveness of Training Against Various Threats Based on Amount ofTraining Received per Month
Percentage responding training protects against threats “well” or “extremely well”

ThreatBusiness Email Compromise attacks
Employees surfing websites that violate
corporate policies (e.g., porn sites)
Malware other than ransomware
Spam
Phishing attacks
Ransomware attacks
Malware infections from web surfing
Account takeover attacks
Targeted attacks
Malware infiltration through web traffic
A breach of sensitive or confidential data
Malvertising©2020 Osterman Research, Inc.

Good security
awarenesstraining resultsin employees
and contractors
who are moreaware ofsecurity threats
and better able
to deal withthem.

Minutes of Training per MonthUp to
15 Mins>15 Mins
Overall
53%
69%
57%
49%

72%

55%

48%
48%
44%
41%
33%
35%
37%
35%
37%
30%

64%
64%
71%
67%
64%
58%
53%
56%
50%
66%

52%
52%
51%
48%
41%
41%
41%
40%
40%
39%

7

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 8 (concluded)
Effectiveness of Training Against Various Threats Based on Amount ofTraining Received per Month
Percentage responding training protects against threats “well” or “extremely well”

ThreatCryptocurrency mining malware being
installed on your internal PCs or servers
Shadow IT - employees using unauthorized
cloud apps and services
Zero-day exploits

Minutes of Training per MonthUp to
15 Mins>15 Mins
Overall
33%

53%

38%

20%

56%

29%

21%

53%

29%

Source: Osterman Research, Inc.

IT IS MORE ENTHUSIASTIC ABOUT TRAINING THAN ARE
RANK-AND-FILE EMPLOYEESOne of the goals of security awareness training is to get employees and contractors
on-board with at least the notion that training is useful in helping them to protect
corporate data and systems. Ideally, however, the goal should be to move employees
from changing their behavior, the fourth step noted in Figure 5, to fundamental
change – a change that results in employees not only changing what they do, butchanging their entire mindset so that they want to practice safe computing to staysafe at work and at home. When employees undergo this fundamental change in theway they approach security, the result is the development of a corporate security
culture.
Figure 9 shows that most organizations are nowhere near approaching that reality
today. While the vast majority of senior IT and business management are on board
with security awareness training, favoring it because they understand its benefits,
most are still not at the point where they have become fundamentally changed as aresult of it. However, for non-senior employees, fundamental change is still further
down the road, with only about one-half of employees participating in their training
not because they understand its benefits, but because they are forced to do so.
Figure 9
Views Among Different Consumer Groups on the Effectiveness of Training

View on the Effectiveness of Training
They think it's a waste of their time, andregularly complain about the training
They participate in the training, but only
because they have to
They are in favor of it because they
understand the benefits of it
They enjoy the training because it helps
them stay secure at work and at home
They don't have an opinion either way

Senior IT
Mgmt.

SeniorBusiness
Mgmt.

Employees

1%

2%

1%

14%

20%

51%

72%

64%

32%

13%

11%

12%

1%

3%

4%

Source: Osterman Research, Inc.

WHAT’S THE BEST FORMAT TO DELIVER TRAINING?

Our research found that IT decision makers and influencers believe that informationbased training with actionable advice is the most effective and engaging type of©2020 Osterman Research, Inc.

8

Security Awareness Training as a Key Element in Changing the Security Culture

training for their employees. The second most popular type of training is considered
to be entertaining, although not necessarily humorous, content.
The survey of IT and security decision makers and influencers conducted for thisprogram found that only 23 percent of organizations always survey employees onwhat they think of the training they receive, while another 52 percent sometimes do
so. As shown in Figure 10, only 50 percent of those surveyed like the quality of thewriting in the training, only 48 percent like the format, and only 45 percent consider
that their training has visual appeal. It’s clear from these results that the quality andenjoyment of training has some way to go.
Figure 10
Training Approach Determined by Employees to be Most Effective andEngaging

Is developing astrong security
cultureimportant?
Source: Osterman Research, Inc.

THE IMPORTANCE OF DEVELOPING A STRONG SECURITYCULTURE VARIES WIDELY

Is developing a strong security culture important? It depends on who you ask. As
shown in Figure 11, 24 out of 25 security IT leaders, as well as the staff members
who report to them, consider the development of such a culture to be either“important” or “extremely important”. Business leaders, on the other hand, while notquite as enthusiastic about the benefits of developing a strong security culture, arelargely onboard with the idea that it’s an important thing to develop for theirorganizations. However, fewer than two-thirds of other employees are similarly
inclined: only 63 percent consider the development of a strong cybersecurity culture
to be “important” or “extremely important”, while more than one-third consider it to
be of only moderate importance.

©2020 Osterman Research, Inc.

9

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 11
Importance of Developing a Strong Cybersecurity Culture
Percentage responding “important” or “extremely important”

Source: Osterman Research, Inc.

THE DISCONNECT BETWEEN DESIRE AND ACTIONSWhat this tells us is that IT, security and business leaders – while generally desirousof establishing a strong cybersecurity culture within their organization – are somehow
not conveying that idea effectively to a large proportion of their employees. This
could be the result of a number of factors, such as high employee turnover,ineffective training, insufficient time given to training, a failure to convey just how
important security really is to the organization, an overreliance on technology to stopthreats, and other factors.
However, as discussed later in this section, a key reason that many employees are
not fully engaged in developing a strong cybersecurity culture may be that their
management has not made it clear just how important users are in the security
process – or management may not actually believe that to be the case. What thisreveals is a significant disconnect between what IT and security management says it
believes about the importance of developing a security culture and what it is doing
about developing one. As discussed in the following pages, users who spend moretime in training and find the training more interesting are more likely to befundamentally changed in terms of their security mindset. This, in turn, will foster the
security culture that IT and security management says they want. Consequently, theonus is on corporate management to make this happen.

EMPLOYEE TIME SPENT IN TRAINING IS INCREASING OVER
TIME
Employees will be spending more time in security awareness training based on the
expectations of IT/security decision makers and influencers, as shown in Figure 12.
Whereas only 26 percent of employees spend more than 15 minutes per month inany type of security awareness training as of mid-2020, that figure is expected tojump to 45 percent by mid-2021. Moreover, the proportion of users who spend notime in training or no more than five minutes per month is expected to fallsignificantly, from 41 percent in mid-2020 to just 17 percent by mid-2021.

©2020 Osterman Research, Inc.

10

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 12
Minutes of Training per Month for the Typical Employee
2020 and 2021

Source: Osterman Research, Inc.

These results tell us that management is increasingly aware of the importance of
security awareness training and devoting a sufficient amount of time to it.

TRAINING INCREASES USERS’ SECURITY SAVVY

IT and security decision makers and influencers clearly understand that security
awareness training provides significant benefits. As shown in Figure 13, IT andsecurity decision makers and influencers had little confidence in the average user’s
ability to detect threats like phishing emails, Business Email Compromise attempts, or
web/social media scams prior to going through training. However, after training theseusers are perceived to be dramatically more capable than they were before – in thecase of phishing emails, for example, the number of users perceived to be “capable”
or “very capable” at detecting these threats jumped nearly six-fold, from 11 percent
to 64 percent.

Management isincreasingly
aware of theimportance of
securityawarenesstraining.

Figure 13
Capability of Users Before and After Training for Various Threats
Percentage of users viewed as “capable” or “very capable”

Source: Osterman Research, Inc.

©2020 Osterman Research, Inc.

11

Security Awareness Training as a Key Element in Changing the Security Culture

The good news here is that IT and security decision makers and influencers really dounderstand just how effective good security awareness training can be in developing
users’ abilities to detect malicious content. The bad news is that the figures in thegreen bars should be significantly greater, since this data tells us that, despite
training, a large proportion of users still is not capable of detecting common security
threats.

Changing User Behavior to Change
the Security Culture
To complement the results of the survey of those who contribute to or influence theirorganization’s security awareness training program, we conducted a survey of 1,000
US-based employees about their security awareness training and other issues. Thissection presents the results of that survey.

USERS WHO FIND TRAINING MOST INTERESTING SPEND
THE MOST TIME INVOLVED IN IT

Our research discovered a strong relationship between the amount of time that users
spend in security awareness training and their level of interest in that training. For
example, as shown in Figure 14, 69 percent of users who find security awarenesstraining to be “very interesting” spend more than 15 minutes per month in any sort oftraining. By contrast, only 37 percent of those users who find security awarenesstraining to be “somewhat interesting” spend this much time in training, while only 16
percent of users who consider their training to be “boring” spend more than 15
minutes per month in training.
Figure 14
User Interest in Training Based on the Amount of Training Received byUsers During a Typical Month

Minutes per Monthin Training
None
Up to 5 minutes per month
6 to 15 minutes per month
16 to 30 minutes per month
31 to 60 minutes per monthMore than 60 minutes per monthUsers’ Interest Level in Training
Somewhat
Very
BoringInteresting Interesting
Overall
43%
18%
4%
23%
23%
19%
10%
18%
18%
27%
16%
21%
10%
22%
24%
18%
4%
12%
23%
12%
2%
3%
23%
8%

Source: Osterman Research, Inc.

There is clearly a relationship between the quality of training and the time spent
involved in that training. If it’s interesting and engaging, users will be motivated tospend more time involved in it, particularly if they’re convinced that doing so will
benefit them personally.

THE PERCEIVED UTILITY OF TRAINING INCREASES WITH
INTEREST LEVEL AND TIME SPENTOur research discovered that the perceived utility of training is closely aligned to boththe interest level that users have in this training and the amount of time they spend
in it. For example, as shown in Figure 15, those who find security awareness training
to be “very interesting” also are most likely to find it has created the type offundamental change discussed in the previous section. Similarly, as shown in Figure
16, a near majority of those who spend the most time in training also become
fundamentally changed in terms of how they think about security.

©2020 Osterman Research, Inc.

12

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 15
Perceived Utility of Training vs. User Interest in Training

Views on Utility of Training
It’s not useful and has made nochange in how I deal withsecurityIt’s somewhat useful and has
gotten me to think more about
securityIt’s quite useful and has caused
me to substantially change how I
think about security
It’s extremely useful and has
fundamentally changed how I
think about security

Users’ Interest Level in Training
Somewhat
Very
BoringInteresting Interesting
Overall
36%

4%

3%

15%

47%

40%

8%

34%

13%

44%

21%

26%

5%

12%

68%

25%

Source: Osterman Research, Inc.

To increase the interest level for security awareness training, the focus should be on
regularly delivered and engaging learning segments that are aimed at targeted
topics. These should be highly engaging, relevant and fairly short and feature themost relevant security topics. A number of new modules should be developed to keep
content fresh and engaging.
Figure 16
Perceived Utility of Training vs. Monthly Time Spent in Training

Views on Utility of Training
It’s not useful and has made nochange in how I deal with security
It’s somewhat useful and has gotten
me to think more about security
It’s quite useful and has caused me
to substantially change how I think
about security
It’s extremely useful and has
fundamentally changed how I think
about security

Up to
5 MinsMinutes of Training per Month
6 to 15Mins>15 Mins
Overall

27%

9%

6%

15%

42%

43%

20%

34%

21%

28%

31%

26%

10%

21%

43%

25%

To increase theinterest levelfor security
awarenesstraining, thefocus should beon regularly
delivered andengaging
learning
segments thatare aimed attargeted topics.

Source: Osterman Research, Inc.

USERS GET BETTER WITH MORE TIME SPENT IN TRAINING
AND MORE INTEREST IN THEIR TRAINING

Not all that surprisingly, we also found a relationship between the interest level andthe amount of time spent in security awareness training and users’ perceptions of
their own ability to detect things like phishing emails and email compromise attacks.
For example, as shown in Figure 17, only 47 percent of users who find security
awareness training to be “boring” believe they are highly capable of detecting aphishing attempt, whereas 73 percent of those who find their training to be “veryinteresting” are capable of doing so. Similarly, as shown in Figure 18, while 50
percent of those who spend no more than five minutes per month in security
awareness training believe they can reliably detect a phishing email, 63 percent ofusers who spend more than 15 minutes per month in training believe they canreliably detect such an email.

©2020 Osterman Research, Inc.

13

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 17
Users’ Ability to Detect Various Types of Threats vs. Interest Level inTraining
Percentage responding that they have a high level of ability

Type of Threat
A mass-mailed phishing email
A spearphishing email thatspecifically targets yourorganization or a group in yourorganization
An email compromise attack thatis supposedly from yourorganization's CEO or anotherleader in your organization
A fake tweet on Twitter
A malicious advertisement on
Facebook

Users’ Interest Level in Training
Somewhat
Very
BoringInteresting Interesting
Overall
47%
50%
73%
55%
38%

43%

79%

51%

40%

44%

73%

50%

30%

34%

66%

41%

36%

37%

68%

45%

Source: Osterman Research, Inc.

Figure 18
Users’ Ability to Detect Various Types of Threats vs. Time Spent in Training
Percentage responding that they have a high level of ability

Type of Threat
A mass-mailed phishing email
A spearphishing email thatspecifically targets your organization
or a group in your organization
An email compromise attack that is
supposedly from your organization's
CEO or another leader in yourorganization
A fake tweet on Twitter
A malicious advertisement on
Facebook

Up to
5 Mins50%

Minutes of Training per Month
6 to 15Mins>15 Mins
Overall
53%
63%
55%

38%

51%

66%

51%

40%

50%

62%

50%

27%

43%

55%

41%

33%

46%

58%

45%

Source: Osterman Research, Inc.

Regularly evaluating employees and tracking indicators across the root causes ofhuman error will enable security teams to assess employees’ risk levels. Theseevaluations might include establishing a base of users’ attitudes and sentiment andthen tracking how these change on a regular basis. It should also include testing theirknowledge of key concepts taught during training modules, as well as phish testing
using real-world examples.

INTERESTING TRAINING AND MORE OF IT BENEFITS USERSPERSONALLY

Ideally, the ultimate goal of security awareness training is the creation of
fundamental change in users as evidenced by users applying the principles they’ve
learned to their non-work life. If the training is effective, it will convince users thatmodifying their behavior and thinking about security in a fundamentally different way
will be to their advantage in all areas of life, both professional and personal.

©2020 Osterman Research, Inc.

14

Security Awareness Training as a Key Element in Changing the Security Culture

Our research found that the more interesting security awareness training is perceived
to be, the more likely that users will fundamentally change their security behavior inareas like changing passwords regularly, eliminating password re-use, or not using
public Wi-Fi hotspots without appropriate protection, as shown in Figure 19.
Figure 19
Extent to Which Training Has Changed Users’ Personal Behavior Based on
Users’ Interest Level in Training
Users’ Interest Level in Training
Somewhat
Very
BoringInteresting Interesting
Overall
I update my passwords on a regular basis
Done this because of training
43%
40%
73%
50%
Considering because of training
14%
25%
14%
18%
Would have done this anyway
26%
29%
11%
23%
Have not done this
17%
6%
3%
9%
I use a unique password for every device and application
Done this because of training
24%
29%
53%
34%
Considering because of training
26%
30%
34%
29%
Would have done this anyway
25%
29%
11%
23%
Have not done this
25%
11%
2%
14%
I changed the password on my home's Wi-Fi router
Done this because of training
18%
25%
52%
30%
Considering because of training
19%
28%
28%
25%
Would have done this anyway
26%
27%
14%
23%
Have not done this
37%
21%
5%
22%
I have enabled 2FA on my banking or other personal accounts
Done this because of training
23%
34%
52%
35%
Considering because of training
17%
22%
31%
23%
Would have done this anyway
37%
32%
14%
29%
Have not done this
23%
13%
3%
14%
I have protected my mobile phone with a PIN or fingerprint
Done this because of training
21%
28%
54%
33%
Considering because of training
15%
19%
26%
19%
Would have done this anyway
44%
42%
14%
35%
Have not done this
20%
12%
5%
13%
I won't access a public Wi-Fi hotspot without a VPN or other protection
Done this because of training
19%
30%
49%
31%
Considering because of training
23%
20%
31%
24%
Would have done this anyway
25%
32%
12%
24%
Have not done this
32%
18%
9%
21%

The moreinteresting
securityawarenesstraining isperceived tobe, the more
likely thatusers will
fundamentallychange theirsecurity
behavior.

Source: Osterman Research, Inc.

Similarly, we also found a strong relationship between the degree to which users
change their personal behavior and the amount of time they spend in security
training. As shown in Figure 20, users who spend more than 15 minutes per month insecurity awareness training are nearly twice as likely to use a unique password forevery device and application as those who spend no more than five minutes permonth in training. The most significant differences we found between those who
receive no more than five minutes per month of training versus those who receive
more than 15 minutes were in the areas of changing the password on their home’s
Wi-Fi router (particularly important in the current work-from-home environment),
protecting their mobile phones with a PIN or biometric authentication, and enabling
two-factor authentication on their banking or other personal accounts.

©2020 Osterman Research, Inc.

15

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 20
Extent to Which Training Has Changed Users’ Personal Behavior Based on
Amount of Time Spent by Users in Training per Month
Minutes of Training per Month
Up to
6 to 155 MinsMins>15 Mins
Overall
I update my passwords on a regular basis
Done this because of training
36%
52%
64%
50%
Considering because of training
15%
26%
17%
18%
Would have done this anyway
31%
18%
17%
23%
Have not done this
18%
4%
2%
9%
I use a unique password for every device and application
Done this because of training
24%
30%
46%
34%
Considering because of training
20%
40%
34%
29%
Would have done this anyway
30%
23%
15%
23%
Have not done this
25%
7%
5%
14%
I changed the password on my home's Wi-Fi router
Done this because of training
17%
31%
42%
30%
Considering because of training
17%
34%
28%
25%
Would have done this anyway
26%
22%
21%
23%
Have not done this
39%
13%
9%
22%
I have enabled 2FA on my banking or other personal accounts
Done this because of training
21%
38%
48%
35%
Considering because of training
17%
28%
26%
23%
Would have done this anyway
39%
26%
19%
29%
Have not done this
24%
9%
6%
14%
I have protected my mobile phone with a PIN or fingerprint
Done this because of training
20%
33%
46%
33%
Considering because of training
10%
30%
24%
19%
Would have done this anyway
49%
28%
24%
35%
Have not done this
21%
10%
6%
13%
I won't access a public Wi-Fi hotspot without a VPN or other protection
Done this because of training
19%
35%
42%
31%
Considering because of training
18%
30%
28%
24%
Would have done this anyway
28%
23%
20%
24%
Have not done this
35%
12%
10%
21%

Source: Osterman Research, Inc.

USERS WHO SPEND MORE TIME IN TRAINING, FIND IT
MORE INTERESTING, SEE THEIR SECURITY ROLE AS MORE
IMPORTANTOne of the keys to developing a robust cybersecurity culture within an organization isto ensure that users see themselves as playing an integral role within that culture. An
organization that views users merely as part of the security problem and not as partof its solution, or relies too heavily on technology, will not develop a strong security
culture.
Our research, as shown in Figure 21, demonstrates that the less security awarenesstraining users receive, the less they see themselves as playing a role in protecting theorganization from cyber threats. For example, while 24 percent of users who spend
more than 15 minutes per month in training see themselves as having little or no rolein protecting their organization from cyberthreats, that figure jumps to 70 percent for
those who spend no more than five minutes per month in training.

©2020 Osterman Research, Inc.

16

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 21
Users’ Self-Perception of Their Role in Protecting the Organization From
Cybersecurity Threats Based on Amount of Training Received Per Month

Source: Osterman Research, Inc.

In a similar way, we found that the more interesting and enjoyable users found theirsecurity awareness training to be, the more they perceived themselves as playing an
integral role in their organization’s cybersecurity protection, as shown in Figure 22.
Figure 22
Users’ Self-Perception of Their Role in Protecting the Organization From
Cybersecurity Threats Based on Their Interest Level in Training

The moreinteresting andenjoyable users
found theirsecurityawarenesstraining to be,
the more they
perceived
themselves asplaying an
integral role.

Source: Osterman Research, Inc.

It’s important to note that the data in the two figures above does not necessarily
show causation. In other words, a user who spends more time in security awarenesstraining or who finds it very interesting is not necessarily more important to their©2020 Osterman Research, Inc.

17

Security Awareness Training as a Key Element in Changing the Security Culture

management in the context of security. However, there is a strong implication that anorganization’s management that devotes more user time to training, and that goes tothe trouble of providing them with engaging content, also considers their users to be
an important component of the organization’s security strategy.

USERS WHO SPEND MORE TIME IN TRAINING THINKMANAGEMENT CONSIDERS THEM TO BE MORE IMPORTANT

While the amount of time that users spend in security awareness training has astrong relationship to the role that users see for themselves in protecting theirorganization from cyber threats, as discussed above, that relationship is lesspronounced when users are asked how they perceive management’s view of them. As
shown in Figure 23, 44 percent of employees who spend no more than five minutes
per month in training believe management sees them as playing an important or veryrole in cybersecurity; that jumps to 63 percent for users who spend more than 15
minutes per month in training.
Figure 23
Users’ Perception on How Management Sees Their Role in Protecting theOrganization From Cybersecurity Threats Based on Amount of Training
Received Per Month

Source: Osterman Research, Inc.

We found somewhat similar findings when comparing the level of interest that users
have in their security awareness training. As shown in Figure 24, the more interest
that users have in their training, the more likely they are to perceive thatmanagement considers them to play an “important” or “very important” role in theirorganization’s cybersecurity protection.

©2020 Osterman Research, Inc.

18

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 24
Users’ Perception on How Management Sees Their Role in Protecting theOrganization From Threats Based on Their Interest Level in Training

Source: Osterman Research, Inc.

USERS WHO ARE TRAINED MORE AND WHO FIND TRAINING
TO BE INTERESTING ARE MORE LIKELY TO BE ABLE TOREPORT SUSPICIOUS CONTENT

Interestingly, there is a relationship between organizations in which corporate
decision makers enable users to report suspicious emails and the like, and those thatprovide more security awareness for these users. For example, as shown in Figure
25, among users who receive no more than five minutes per month of security
awareness training, 75 percent have the ability to report suspicious content to their
IT and/or security team, and 14 percent really aren’t sure whether they can do so ornot. In contrast, among users who spend more than 15 minutes per month intraining, 93 percent can report suspicious content and only one percent of thoseusers are unaware of whether or not they can do so.

©2020 Osterman Research, Inc.

Users who aretrained more
and who findtraining to beinteresting are
more likely tobe able reportsuspicious
content.

19

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 25
Ability for Users to Report Suspicious Content Based on Amount of Training
Received Per Month

Source: Osterman Research, Inc.

We found a similar relationship between users’ level of interest in their security
awareness training and the proportion that can report suspicious content. As shownin Figure 26, among those who find their training to be “boring”, only 76 percent canreport suspicious emails and the like. However, among those who find their training
to be very interesting, 95 percent can report suspicious content to their IT and/or
security teams.
Figure 26
Ability for Users to Report Suspicious Emails, Attachments, etc. Based on
Their Interest Level in Training

Source: Osterman Research, Inc.

©2020 Osterman Research, Inc.

20

Security Awareness Training as a Key Element in Changing the Security Culture

Here again, this tells us that senior management that goes to the trouble of providing
a greater quantity of more engaging security awareness training considers users to
be more important to the overall security strategy than senior management that does
the opposite. This is manifested, in part, by enabling users to provide feedback to IT
and security on suspicious content that they receive.
Interestingly, we found that the more security awareness training that users receive,and the more interesting they find it, the greater the volume of emails that theyreport as suspicious during a typical month. For example, only five percent of users
who receive no more than five minutes of training per month report more than 10
suspicious emails per month; 46 percent of users who receive more than 15 minutesof training per month report more than 10 emails. Similarly, only 16 percent of those
who find training to be boring report more than 10 emails per month versus 44
percent of those who find their training to be interesting.

USERS WHO RECEIVE MORE TRAINING AND FIND IT MORE
INTERESTING ARE BOTH MORE APPRECIATIVE AND
CRITICAL OF TRAINING

As we have noted earlier in this report, an increase in the amount of security
awareness training (to a point) offers a number of important benefits. While Figure
27 also reveals that more training results in more benefits, it may be that users who
spend more time in it also may become somewhat more critical of it. For example,
the more time that users spend in training, the more they believe that the training is“too wordy”, “too technical” or feel as though they are being “talked down to” by thetraining. As shown in Figure 28, we found similar – and in some cases, stronger –results in this regard in the context of the level of interest that users have in theirtraining.
Figure 27
Agreement With Various Aspects of Training Based on Amount of Training
Received Per Month
Percentage responding “agree” or “strongly agree”

Aspects of Current Training
It gives security advice I can use
It speaks in a way I can clearly
understandIt’s relevant to my responsibilities
I like its use of real-world examples
I learn a lot from it
It’s well written
It provide the right amount ofinteractivity
It lasts the right amount of time persessionIt’s visually appealing
It’s too technicalI feel like the training is talking down
to me
It’s too wordy
It’s ugly or bland to look at

Up to
5 Mins40%

Minutes of Training per Month
6 to 15Mins>15 Mins
Overall
60%
73%
57%

41%

60%

70%

56%

41%
39%
33%
34%

55%
57%
55%
48%

70%
70%
69%
66%

55%
54%
51%
49%

31%

52%

66%

48%

33%

45%

63%

47%

27%
18%

43%
36%

62%
44%

44%
32%

19%

36%

45%

32%

20%
17%

33%
33%

40%
40%

30%
29%

An increase in
the amount of
securityawarenesstraining (to apoint) offers anumber ofimportantbenefits.

Source: Osterman Research, Inc.

©2020 Osterman Research, Inc.

21

Security Awareness Training as a Key Element in Changing the Security Culture

Figure 28
Users’ Agreement With Various Aspects of Training Based on Interest Level
Percentage responding “agree” or “strongly agree”

Aspects of Current Training
It gives security advice I can use
It speaks in a way I can clearly
understandIt’s relevant to my responsibilities
I like its use of real-world
examplesI learn a lot from it
It’s well written
It provide the right amount ofinteractivity
It lasts the right amount of time
per session
It’s visually appealing
It’s too technicalI feel like the training is talking
down to me
It’s too wordy
It’s ugly or bland to look atUsers’ Interest Level in Training
Somewhat
Very
BoringInteresting Interesting
Overall
35%
58%
85%
57%
37%

53%

85%

56%

35%

55%

82%

55%

34%

55%

80%

54%

29%
29%

49%
47%

83%
80%

51%
49%

29%

45%

80%

48%

25%

45%

78%

47%

22%
23%

40%
21%

77%
57%

44%
32%

26%

17%

61%

32%

23%
22%

19%
16%

54%
56%

30%
29%

Source: Osterman Research, Inc.

These results were not really all that surprising. For just about any user, the moretime they spend using something, the more they discover things they like and dislike
about it. A user of Microsoft Excel, for example, will find previously undiscoveredfeatures that they can put to good use the more they use the software, but they will
also discover previously unknown quirks and bugs.

Steps to Improving the Security
CultureOsterman Research offers the following recommendations for decision makers toconsider as they evaluate the role that security awareness training should play intheir organizations:•Get buy-in from the board of directors and senior management
Arguably, the most important single element of success for any security
awareness training program will be obtaining buy-in from senior management
across the organization, including the board of directors. Senior managers orboard members who see little value in good security awareness training, or who
see employees as an encumbrance to good security rather than part of thesolution to security problems, are very unlikely to support any meaningfultraining program. Moreover, senior management must be willing consumers of
the training, not merely those ordering those beneath them to go through it
while not going through it themselves. In short, if security awareness training is
to be successful, it must first find strong support among those who have thepower to make it successful.
Moreover, senior managers must focus not on training per se, but on training
with a view to creating fundamental change in the security mindset of users,
which, in turn, will create a security culture in the organization.

©2020 Osterman Research, Inc.

22

Security Awareness Training as a Key Element in Changing the Security Culture•

Train users with a view toward fundamental change
The fundamental goal of security awareness training must be to affectsubstantive and permanent change in the security practices of those who learn
from it, not merely “checking the boxes” that they understand security. Whenemployees go through training and then willingly put into practice what they’ve
learned, both professionally and personally, that will be the sign that the training
has hit its mark and moved the organizational culture closer to that of. This
fundamental change must become an essential part of how employees andcontractors work with communications systems, corporate data sources, cloudservices, and the like. In essence, good security awareness training will result insomething akin to “muscle memory;” that is taking the most secure actions
possible in a given situation almost automatically.

•

Figure out if your current culture supports good training
Not all corporate cultures will lend themselves well to making the sort offundamental changes that are necessary to create a security-focused culture. If
senior managers are not teachable, if employees are resistant to the idea ofchange or implicitly rewarded for not changing, or if management merely gives
lip service to good security awareness training without providing adequate
funding and effort to make it happen, the culture simply won’t change.

•

Make sure that training is adequate and tailored to the organization
Security awareness training must address all of the issues that are relevant to
the organization, including those that are specific to the organization and theindustry in which it operates. Generic training will be useful to a point, but it
must include specifics that will enable employees to address their uniqueobligations and requirements.

•

Make training interesting and engaging
Security awareness training that is dull and boring won’t be nearly as successfulin accomplishing its goals as that which is interesting and engaging. As discussed
in this paper, the more interesting that users find training to be, the more
effective it is in accomplishing its goals of helping to develop the necessarychange in users’ security mindset.

•

Measure your success and identify areas for improvement
It’s important to measure the success of any security awareness training
program with the goal of making improvements in how information is presented,
how receptive users are to the information presented to them, and how effective
it actually is in changing the corporate culture. The survey of IT and security
decision makers and influencers conducted for this program found that only 23
percent of organizations always survey employees on what they think of the
training they receive, while another 52 percent sometimes do so. The IT/security
survey also found that these surveys reveal that only 37 percent of employees
really enjoy the training they receive, revealing that there is significant room for
improvement in making the content more engaging.

•Training should be more positive than punitive
Finally, as many have said in the past, security awareness training should be
primarily about enforcing positive changes, not punishing negative ones. To be
sure, an employee who goes through training and continues to practice risky
behaviors should be dealt with appropriately, but positive reinforcement will
generally be more effective in accomplishing the long-term goals of fundamental
change that most organizations are seeking from their investments in training.

©2020 Osterman Research, Inc.

The
fundamental
goal of security
awarenesstraining must
be to affectsubstantive
and permanentchange.

23

Security Awareness Training as a Key Element in Changing the Security Culture

Summary
Good security awareness training is an essential element in improving any
organization’s security defenses because it gives employees and contractors theknowledge and skepticism necessary to avoid making mistakes that could lead tosecurity problems like ransomware infections or data breaches. The fundamental goalof any security awareness training should be the development of fundamental changethat will fundamentally alter the behavior of employees and lead to the developmentof a truly security-focused corporate culture.

Sponsors of This White Paper
INFOSECAt Infosec, we believe knowledge is the most powerful tool in the fight against
cybercrime. We help IT and security professionals advance their careers with a full
regimen of certification and skills training. We also empower all employees withsecurity awareness training to stay cybersecure at work and home. Driven by smart
people wanting to do good, Infosec educates entire organizations on how to defend
themselves from cybercrime. That’s what we do every day — equipping everyone
with the latest security skills so the good guys win.
Infosec IQ security awareness training empowers your employees with theknowledge and skills to stay cybersecure at work and home. With over 2,000
awareness and training resources, you’ll have everything you need to prepare
employees to detect, report and defeat cybercrime. Every aspect of the platform canbe customized and personalized to match your organization’s culture and employees’
learning styles.

www.infosecinstitute.com/securityiq
security@infosecinstitute.com@InfosecEdu+1 708 689 0131

To learn more, visit: https://www.infosecinstitute.com/iq/

KNOWBE4

KnowBe4, the provider of the world’s largest integrated new-school security
awareness training and simulated phishing platform, is used by morethan 30,000 organizations worldwide. KnowBe4 was created to help organizations
manage the ongoing problem of social engineering through a comprehensive newschool awareness training approach. Organizations leverage KnowBe4 to enable theiremployees to make smarter security decisions and create a human firewall as aneffective last line of defense. To learn more, please visit www.knowbe4.com.

www.knowbe4.com@KnowBe4
info@knowbe4.com+1 855 566 9234

MEDIAPROMediaPRO security and privacy training solutions are used by organizations of all sizes
to protect sensitive data, demonstrate compliance, and reduce the risk to theirreputation and bottom line. With MediaPRO, it’s easy to keep employees engaged
and track program effectiveness. And, unlike phishing-focused security awarenesstraining solutions, MediaPRO covers security, privacy and compliance so you canaddress a more complete threat landscape. MediaPRO has been named a leader in
Gartner’s Magic Quadrant for Security Awareness Computer-based Training for six
years in a row.

©2020 Osterman Research, Inc.

www.mediapro.com@MediaPROInc+1 800 726 6951

24

Security Awareness Training as a Key Element in Changing the Security Culture

MIMECAST

Developed by top leadership from the U.S. military, law enforcement and theintelligence community, Mimecast Awareness Training is a security awarenesstraining and cyber risk management platform that helps you combat information
security breaches caused by employee mistakes.
Human error is involved in 95 percent of all security breaches. But humans aremaddeningly careless and resistant to change. Employees’ casual mistakes lead todisaster all the time — and cost people their jobs. To change security culture
effectively, employees have to know what to do, care enough to improve, and thendo what’s right when it matters.

www.mimecast.com@Mimecast
info@mimecast.com+1 617 393 7000

You need to drive gut-level behavior improvements at scale. That is what Mimecast
Awareness Training’s cyber security training platform delivers.
Mimecast Awareness Training combines effective, modern training techniques withpredictive analytics to solve for your company's vulnerability to human error.
From ransomware and phishing to unattended laptops and CEO fraud, the threats aremany and they are real. There are plenty of bad actors ready to take advantage ofyour employees’ mistakes. And even when mistakes are not being engineered andleveraged by malicious outsiders, poor cyber habits can lead to difficult and costly
situations for you and your team. Mimecast Awareness Training helps you mitigate
cyber risk stemming from the simple mistakes your employees are making every day.

© 2020 Osterman Research, Inc. All rights reserved.
No part of this document may be reproduced in any form by any means, nor may it be
distributed without the permission of Osterman Research, Inc., nor may it be resold or
distributed by any entity other than Osterman Research, Inc., without prior written authorizationof Osterman Research, Inc.
Osterman Research, Inc. does not provide legal advice. Nothing in this document constitutes
legal advice, nor shall this document or any software product or other offering referenced herein
serve as a substitute for the reader’s compliance with any laws (including but not limited to any
act, statute, regulation, rule, directive, administrative order, executive order, etc. (collectively,“Laws”)) referenced in this document. If necessary, the reader should consult with competent
legal counsel regarding any Laws referenced herein. Osterman Research, Inc. makes norepresentation or warranty regarding the completeness or accuracy of the information containedin this document.
THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. ALL EXPRESS OR
IMPLIED REPRESENTATIONS, CONDITIONS AND WARRANTIES, INCLUDING ANY IMPLIEDWARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE
DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE DETERMINED TO BE
ILLEGAL.

REFERENCES
i

Richard Steinnon, Security Yearbook 2020: A History and Directory of the IT Security

Industryii

https://www.criticalstart.com/new-research-from-criticalstart-finds-that-8-out-of-10-securityanalysts-report-annual-security-operations-center-turnover-is-reaching-10-to-more-than-50/

iii

SE Labs, Email Security Services Protection, Jan-Mar 2020

©2020 Osterman Research, Inc.

25