All enterprises conduct security awareness training for their employees. But whether this has tangible benefits is debatable.
Empirical evidence suggests that security awareness training isn’t working – successful attacks keep increasing. But opinions on the efficacy of awareness training range from it doesn’t work to it does work, with sometimes, perhaps and depends between the two extremes.
Awareness training focuses on two tasks: to reduce the effect of bad judgment turning an employee into an insider threat; and to harden employees against falling to malicious social engineering. We focus on social engineering.
Compliance theater
The majority opinion is that awareness training is important but not always effectively delivered – and not necessarily at the fault of the company concerned. Stefan Dasic, senior malware research engineer at Malwarebytes, suggests, “Most training programs fail because of how they’re run.” He believes they are repetitive and generic, making them seem pointless.
“Some of that repetition isn’t just poor design though – a lot of it is driven by compliance and insurance requirements that mandate the same content be re-delivered to every employee every year, regardless of whether they already know it.” The danger here is that awareness training is reduced to an annual legal checkbox.
Robert Costello, chief digital and information officer at Merlin Group, has similar concerns. “Too much of today’s training is compliance-focused and doesn’t reflect the sophisticated social engineering and AI-enabled attacks organizations face today.”
Mike Lyman, senior security consultant at Black Duck, expands on this concern. “Re-taking identical courses across multiple employers is a good concrete illustration of training-as-compliance-theater: the kind of thing that produces checkbox completion without any behavior change and may explain why some studies find weak or null effects even where completion rates are high.”
The problem with compliance requirements, and not just in awareness training, is that it provides a level that can be viewed as a target to achieve rather than a baseline that can be improved.
Where and when training works
Drew Thompson, global lead for training and enablement at UltraViolet Cyber, believes awareness training works, but primarily for the specific situations covered by the training. The problem, however, is, “The attackers keep changing what they are doing, and the training is often trying to prepare people based on what we already know.”
Josh Bartolomie, VP, global head of threat intelligence at Doppel, agrees. “Security awareness training still works, but many organizations are expecting it to solve a problem that’s changed.”
Thompson suggests training should be more frequent, should evolve more in line with the evolving attacks, should include direction on reaction to suspicious messages (behavioral training), and be more focused on the employee’s role in the business.
“And,” he adds, “training cannot be the only control. It needs to be backed by good processes, identity protections, technical controls, and clear verification procedures.”
Bartolomie adds, “Awareness remains essential, but it can’t be the only line of defense. We can no longer expect humans to be the final line of defense against threats. Technology should be that.”
Costello says, “Security awareness training still has a role; however, it should reinforce a modern security architecture, not compensate for the lack of one.”
[ Read: Social Engineering Detection Moves Into the Live Conversation ]
Biswajit De, co-founder and CTO at CleanStart, adds, “Awareness should complement engineering, not replace it. Good engineering assumes things will fail, and good security should assume people occasionally will too.”
Jim Dolce, CEO at Lookout, believes training can be useful, “but is fundamentally outmatched within today’s mobile AI threat landscape. The attempt to turn employees into a human firewall through training belongs to the earlier desktop-centric age.”