Scan recent headlines for news about breaches and it’s immediately apparent why leaders are concerned about their organization’s security posture. Recent Fortinet research shows that nearly 90% of enterprises experienced one or more breaches in the past year, and 67% of leaders say that a lack of employee security awareness contributed to those incidents.

At the same time, cybercriminals are raising the stakes as they increase the volume and velocity of the threats they deploy, with leaders worrying that these emerging attack tactics, particularly those involving AI, will be more challenging to spot and block than “traditional” cyberattacks. The ongoing skills shortage also continues to plague enterprises, with many security and IT teams lacking the staff and skills necessary to protect their organization.

As organizations navigate these complexities, they must take an “all-hands-on-deck” approach to security. That’s why security awareness and training are  foundational parts of any robust risk management strategy. There are key considerations you must pay attention to as you deploy new training initiatives or reevaluate existing programs.

Cybersecurity is everyone’s job

Last year, 80% of organizations experienced malware, phishing, and web attacks, all directly targeting users. This insight underscores how crucial it is to build a cyber-aware workforce. A skilled team of professionals and the right security technologies are undoubtedly important, but your first line of defense against cybercrime is your employees.

It’s encouraging to see more leaders prioritizing security education within their enterprises. According to the Fortinet 2024 Security Awareness and Training Global Research Report, 97% of executives believe that more training and awareness would help reduce cyberattacks, which is up from 93% the previous year. Of those executives whose organizations already have a security training and awareness program, 89% reported improvements to their security posture after implementing these initiatives.

These are vital attributes of any security awareness and training program

Developing and managing a security awareness and training initiative is no small feat, but careful consideration and planning can significantly bolster your broader security efforts. To maximize the program’s effectiveness and participation, leaders should discuss and align the program vision and goals, training format and delivery schedule, and content.

Articulate the program vision and goals

Research shows that employees are open to cybersecurity awareness and training opportunities. Most leaders (86%) say their employees view security awareness and training positively, with 55% saying “very positively.”

While this receptiveness is good news, several factors can make (or break) security awareness and training programs, regardless of how open employees are to the idea. Many leaders mistakenly believe introducing a security awareness initiative will automatically alter user behavior. Executives need to articulate and communicate the program’s vision and goals, repeating them often, and this information needs to come from more than just your CISO. When leaders throughout the enterprise strongly back security awareness and training, organizations are more likely to see some or significant improvement after implementation. More than 90% of those surveyed who said they had “extensive” leadership support reported some or significant improvements once the initiative was introduced.

Choose the appropriate training format and delivery schedule

Security awareness and training must be intentional and engaging; the format and delivery schedule you choose will impact the success of your initiative. As proof that security awareness and training is a disciplined and well-considered undertaking in most organizations, 75% of respondents say they plan their campaigns in advance, with an average of three hours of training per year considered adequate. Eighty-one percent (81%) of organizations run security awareness and training for employees monthly or quarterly. That regularity offers opportunities for refreshers and reinforcement and net-new training on emerging threats and industry-specific topics.

Include engaging content

While most organizations are satisfied with their current security awareness and training service, those who are somewhat or not satisfied cite a lack of engaging content (41%) as the primary reason. Your security awareness and training program should be unique to your business and include content tailored to the enterprise’s needs. However, certain pieces of cybersecurity knowledge should be included in every training effort. All programs should address critical areas of concern, such as phishing attacks, ransomware, social engineering, remote work, passwords and authentication, and more.

Evaluate (and reevaluate) security awareness and training efforts

Security training initiatives play a leading role in combatting cybercrime. Related efforts help IT, security, and compliance leaders create a more cyber-aware culture, giving employees the necessary knowledge to recognize and avoid falling victim to attacks.

If you have an existing program, revisit the content and delivery methods periodically to ensure you’re covering suitable topics and evolving the effort to meet the organization’s changing needs. If you have yet to implement enterprise-wide security awareness and training, consider whether you want to develop it in-house or work with a vendor. There are high-quality SaaS-based offerings available that deliver comprehensive and timely curriculum. Look for training services that include campaign and user activity tracking with easy-to-use reporting, an intuitive administrative interface, and the ability to customize or co-brand the offering.

The threat landscape will only intensify in the future, making it vital that each individual helps prevent breaches. Involving the entire organization in cybersecurity efforts benefits everyone.