Almost all of the organizations surveyed, a total of 97%,reported implementing some type of cybersecurity awareness training measures this past year, with most now using a combination of both phishing simulations and security awareness training. However, of the 1,900 security professionals surveyed, just 42% reported involving their employees in security detection with the use of such measures as a Phishing Incident Button. It’s an important distinction as this type of engagement is known to further security by creating a virtual ‘human firewall’ and accelerating the reporting of potential threats.

“These statistics tell us two things. The first is that cybersecurity awareness is now reaching its adolescence with almost universal agreement that regular training improves enterprise security in a way that technology alone cannot,” said Aaron Bostick, CISO, North America at ThriveDX. “Secondly, these numbers show us that we still have a long way to go to reach maturity and an understanding that the only true way to mitigate modern cyber risks is by positively changing employee behavior and building positive security cultures within our companies.”

Sixty-five percent of IT professionals surveyed did agree that their cybersecurity awareness training programs need expansion, and no one indicated a desire to reduce their current engagement. However, only 20% of participants reported conducting more than seven phishing simulations per year, and just 67% invested up to 12-hours per year in awareness training.

The results of employee awareness efforts were impressive across the board with 19% reporting better awareness; 14% greater vigilance; 12% said they increased their human firewall; and 99% reporting an increase in corporate security. Ninety-six percent also noted a positive influence on their enterprise’s overall working atmosphere. Survey participants reported that the most important success factors were training course duration, an entertaining nature, customization, and individualization.

“This really validates the human-centric approach that we take towards security awareness,” Roy Zur, CEO of ThriveDX for Enterprise, said. “Involving employees, offering customized security awareness training, and gaining their commitment to security is the number one way to mitigate cyber risk.”

Other key findings:

• Currently, the most popular training topics are courses on phishing and malware, password security, email security, social engineering and ransomware.
• 72% refrain from pre-announcing phishing campaigns to employees
• The biggest challenges cited in implementing awareness programs were achieving user acceptance (25%), workload and resources (22%) and program execution (14%)
• The use of mission statements, policies, guidelines, metrics and systematic training is increasing with 58% of respondents reporting some form of security awareness regulations in place.

The full 2022 Global Cybersecurity Awareness Training Study is available here.