Why Security Awareness Training Fails, And What To Do Instead
Demonstrates why Security Awareness Training Fails, And What To Do Instead and evaluates key implications for security practitioners.
Summary
Overview: A WICCON presenter argues security awareness training fails to change behavior, using a purchased-but-unused barbell metaphor and offering three options including a psychology-based alternative.
Key Topics: The gap between awareness and behavior change; why annual training doesn't work; assume-breach as giving up on people; and psychology-informed alternatives to traditional awareness programs.
Technical Details: The speaker, a psychologist, demonstrates that knowing exercise is healthy and buying equipment doesn't produce behavior change—paralleling how security awareness doesn't prevent risky actions despite employee knowledge.
Takeaways: Security awareness training alone cannot change behavior. Organizations should adopt psychology-informed approaches or accept assume-breach rather than pretending training solves human risk.
Related talks
Kaspersky·6 min
Presenters detail vulnerability discovery and exploitation in Cybershare: Security Awareness Training and Awareness | Part 3 - Routes Into Cyber.
Kaspersky·9 min
Security Training
Security Training investigates Cybershare: Security Awareness Training and Awareness | Part 2.
Kaspersky·6 min
Cyber Awareness Culture
Cyber Awareness Culture investigates Cybershare: Security Awareness Training and Awareness | Part 1.