How do you keep security awareness content relevant?

As a Sales Manager at Scylla AI, I find that tailoring security content to specific audience needs is essential. Using AI-driven insights and real-time data ( even in photo/video formats) helps keep the content relevant and engaging. Regular updates and diverse formats, along with practical examples, ensure that the material remains impactful and easy to understand.

Trabalhar com a conscientização em segurança desde a entrada do colaborador na companhia e no departamento. Alinhar os métodos de report com o cenário da companhia e recursos disponíveis, e trabalhar por meio do exemplo, não pela punição, são alguns dos fatores de sucesso. Quando você possui uma cultura por colaboradores mais antigos de casa, que já passaram por este programa e tem isto em seu DNA, fica mais fácil os novos seguirem pelo exemplo, para isto, é fundamental o alinhamento dentre seus objetivos, público-alvo e linguagem utilizada.

Content on security awareness should be updated frequently to take into account the most recent security trends and the state of threats. It should also be customized to the objectives and culture of the company as well as the unique roles, responsibilities, and needs of the staff. Using a variety of formats, including games, quizzes, stories, and films, security awareness information should be entertaining, interactive, and engaging. In order to reinforce the most important ideas and behaviors, security awareness content should be provided in brief, frequent sessions across a variety of platforms and channels.

Understand, Adapt, Engage! 🎯📚 I'd keep security awareness content relevant by assessing the audience to ensure the information meets their needs and knowledge level. Align content with organizational goals and current security threats. Update material regularly to reflect the latest cybersecurity trends and threats. Use various formats like videos, quizzes, and infographics to cater to different learning styles. Incorporate storytelling to make the content more relatable and memorable.

Tailoring by department might be the best suggestion out there. If you want to have a success security awareness campaign, you have to align the training with possible threats on tasks that they are familiar with.

Before understanindg your peers, understanding the threat factors and attack methods that can be used to trick your employees in doing something they are not supposed to do is key. Updating material to the ever involving threat landscape is even more important than understanding knowledge levels or learning habits. That last should be an ongoing evaluation of your security awareness program and not something done just before updating material.

Customising the content to suit your audience's specific needs is essential. Focus on making the material directly relevant to their daily work routines and the particular cyber threats they may encounter. Crafting high-quality content is only part of the equation. The training must resonate on a deeper level to drive adoption and engagement. It should instil a sense of personal conviction, highlighting its relevance to employees' roles and lives within the digital world. Addressing the 'what's in it for me' question is crucial, which many cyber training companies often miss. By successfully connecting the training to their personal and professional lives, you can significantly influence a positive change in their cyber hygiene habits

Understanding your audience is a crucial step in creating effective security awareness content. Utilizing surveys, quizzes, interviews, or focus groups helps assess the current awareness level, learning preferences, and specific needs of employees. Tailoring content based on roles, departments, or locations ensures relevance and resonance. Segmentation by topic, difficulty, or format enhances accessibility, making it easier for employees to engage with and comprehend the information. This personalized approach maximizes the impact of security awareness initiatives, fostering a culture of vigilance and proactive cybersecurity practices within the organization.

Don't forget to make it a memorable and fun learning experience. By default, unless you are security champion, most people feel negative emotions when they hear the word security. It causes more stress and they see it as a burden. They also now that it is mandatory compliance training, but if you want them to comply by free will, understand how their behavior impacts your cyber security posture, than make it fun for them to learn, experiment and understand within their map of the world. It is always about keeping in mind the general learning path of: 1. Raising Awareness 2. Building Understanding 3. Fostering New Habits

I reckon aligning security awareness content with organizational goals is key. Clear objectives and measurable outcomes ensure that the content supports our security policies and procedures effectively. Using practical examples to illustrate these principles helps employees understand their importance and application in daily work. Excellent points in this article!

It is extremely important to analyze the current maturity level of the organization as a whole when it comes to awareness and identify the high-risk areas and users. Based on this you can set goals and design your awareness program around it. If you try to do everything at once, it may be overwhelming for the users and you may not get the desired outcomes. In my experience, it is recommended to start with training users about the organization's security policy and general best practices through foundational training. It is also important to decide how you will measure the success of your awareness program.

Effective security awareness content serves as a strategic tool aligned with overarching security goals. Establishing a clear vision and measurable objectives for the awareness program is essential. The content should be closely aligned with security policies, standards, and procedures, elucidating the reasons behind them. Communicating the benefits of compliance and consequences of non-compliance adds context. Practical examples and scenarios contextualize security principles, empowering employees to apply them in their daily activities. This approach fosters a deeper understanding, commitment, and adherence to security best practices throughout the organization. Regular evaluation ensures the content's effectiveness in achieving set goals

Even more important, security awareness should be aligned with the business goals. Then, someone from marketing for example will not have to do a separate training about security awareness, but can learn how to develop cyber hygiene within their marketing map of the world and link it to the overall business bottom-line. Security awareness is enabling businesses to operate securely and protect customer and stakeholder data, while being innovative and creating a solid customer experience. If security and innovation are perceived as mutually exclusive, you will only create more resistance to change in building a healthy security culture within the company.

Aligning security awareness content with your organization's overall security objectives ensures a unified approach to risk management. Clearly defined goals, backed by practical examples, help employees understand the real-world implications of security policies. Content that reflects your standards and procedures not only educates but also fosters a culture of compliance. How do you measure the alignment of your security awareness initiatives with your broader security goals?

At Scylla AI, we prioritize regularly updating our security awareness content to stay ahead of evolving threats. We use analytics and feedback to refine our materials, ensuring they remain accurate and relevant. Keeping employees informed about updates and encouraging them to refresh their knowledge is key to maintaining robust security practices.

Off-the-shelf training is no longer enough. The types and modus operandi of attacks are ever-changing. There is an increased need to educate users about the new ways threat actors are trying to deceive them. This makes it very important to update training regularly. Apart from updating the existing training, another cost-effective way is to regularly share infographics, posters, case studies, and newsletters with users. User feedback, and surveys also are a great way to know where improvements can be made for better user engagement.

To keep security awareness content relevant, including references to current events helps content be more engaging. After the success of the 2022 Super Bowl viral Coinbase QR code commercial, I created content focused on QR code phishing and provided a forum where our employees could create their own QR code.

Atualizar os conteúdos regularmente e se manter atualizado com as ameaças mais recentes é fundamental para profissionais que atuam no gerenciamento de programas de conscientização. Uma boa prática é criar uma rotina periódica de atualização do plano, onde você pode substituir ações já ultrapassadas por outras mais relevantes. Assim, você mantém o conteúdo relevante para os usuários.

The goal of regular updates is not just to keep the content current, but also to keep security at the forefront of everyone’s mind, fostering a culture of security awareness within the organization.

Make sure to use 'employee feedback' on your security awareness training. The more user friendly security awareness training is, the better it meets the needs from your employees, the higher the compliance rates and the more people will focus on developing cyber hygiene habits.

In the ever-changing landscape of cybersecurity, keeping content current is critical. Regular updates ensure that your training reflects the latest threats and technologies, maintaining its relevance and effectiveness. Monitoring feedback and analytics provides insights into areas that may need refinement. A continuous improvement loop, informed by data, helps keep your program sharp. How do you prioritize updates to ensure your content stays ahead of emerging threats?

A campaign should not be viewed as a stand-alone measure, but as part of a larger whole, i.e. a security strategy. In order to know whether a campaign and its measures have led to the desired success, i.e. whether a security-conscious corporate culture has emerged, it is important to measure the corporate culture regularly and adapt the strategy accordingly. It is therefore important that you develop measures in advance that can be verified.

Esta es una parte muy importante. Normalmente, las personas son reacias a recibir constantemente "regaños" sobre lo que no debe hacer. La idea es ser creativo a la hora de realizar actividades de concienciación, para evitar caer en la monotonía, que la información sea atractiva y a su vez se aprenda de ella.

Consider the platforms that you have available to you and also consider what is popular in the social media realm. If it works on Facebook and tik Tok it will probably work in your platforms. Micro learnings like 1-2 minute quick-hit videos on high priority topics, memes, infographics, chat messages, these are all ways to reach your employee audience in ways that will likely resonate, and also won’t demand too much of their time. Always remember to meet your Audience where they are, not where you want them to be.

Today the average attention span is around 8 seconds thanks to TikTok and Instagram. Long-format training doesn't work. Instead of making users watch long and boring training, it is better to create highly engaging content that users will like. Micro-learning, Nano-learning videos, and animated videos are the way to go. These usually take anywhere from 30 seconds to 120 seconds to consume. Visually appealing infographics, comics, and artwork also work well and take anywhere from 5 seconds to 60 seconds to consume. If you use all the various formats effectively, the users can have a great learning experience without having to spend too much time on it.

From my expereince, we utilize a variety of formats—like e-learning, videos, and simulations—to cater to different learning styles and preferences. Balancing content length and delivery timing helps prevent information overload and keeps employees engaged. Offering accessible, concise, and engaging content is crucial for effective security awareness.

Diversifying content formats is key to catering to different learning styles and keeping engagement high. From videos to interactive games, a mix of formats can make security training more accessible and enjoyable. Short, focused sessions help prevent overload, allowing employees to absorb information more effectively. How do you determine which formats resonate best with your workforce to maximize engagement and retention?

Para garantir o sucesso do programa a diversificação das estratégias se faz necessária, pois temos que alcançar todos os tipos de público. Entender que o tema de SI deve chegar em diversos formatos, para que os colaboradores consumam da forma que mais lhe atrai, o uso de vídeos (shorts) por exemplo, pode ser uma ótima saída (conteúdo curto e objetivo), plataformas de Gamificação são bem atraentes, não esquecendo dos meios tradicionais como e informativo por e-mail.

Not everyone learns effectively and efficiently in the same way. Therefore, it is important in information security campaigns to consider the different learning styles and cover them with the appropriate campaign and training materials. There are four learning styles: Visual learner Auditory learner Cognitive learner Tactile learner Ideally, you cover all four learning styles. However, this can prove more difficult than you think.

Using stories is a great way to make learning about cybersecurity fun and interesting. I recently wrote a book about cybersecurity for everyday individuals, and I've found that using simple, everyday analogies makes the complicated parts of staying safe online easier to understand and appreciate. It's really effective to have people learn about cybersecurity and then get them to teach it to others at the end of the course. When we know we have to teach something, we usually learn it better and more deeply.

We use storytelling to enhance the relevance and impact of our security awareness content. By sharing real-world examples and relatable scenarios, we make security practices more memorable and persuasive. Engaging stories help evoke emotions and motivate employees to adopt better security behaviors

O Storytelling é uma técnica fantástica para manter programas de conscientização interessantes para o público, pois é possível exemplificar e tangibilizar as situações para mostrar (quase) na prática que é possível ter um comportamento seguro, mesmo sem ser um profissional de segurança.

Storytelling brings security awareness to life, making it more relatable and memorable. Real-world examples of breaches or best practices can resonate deeply, driving home the importance of security. Emotional connections fostered through stories can motivate behavioral change, turning abstract concepts into tangible actions. How do you leverage storytelling in your security awareness program to create a lasting impact on your employees?

This is such a powerful way to instil a security first mindset, but can feel counter intuitive at the same time. When you start with security first, you are likely to trigger people's defense mechanism. They don't want to hear it or act upon it because of their current workload, their perception of security and the additional stress or fear it causes. But if you start with their core values, their emotional needs and link it to having a higher quality of life at work - than you are lowering their resistance to understand the innovative ways security awareness helps them.

Monitor what your competitors are posting ;) It will give you much more insights what are their weaknesses, so you can cover from your side

Stay current! Monitor industry trends and emerging threats. Tailor content to address specific risks and challenges faced by your organization. Solicit input from employees to ensure content resonates.

Incorporating gamification into your security awareness program can be an innovative way to boost engagement. Challenges, leaderboards, and rewards can create a competitive yet educational environment, encouraging employees to participate actively. Gamification taps into intrinsic motivation, making learning more fun and effective. Have you explored gamification in your security training, and what outcomes have you observed?

The word 'relevant' here is something to delve deeper into. For people attending awareness sessions, I'd suggest that 'relevant' would be better termed 'relatable'. i.e. Do they see an issue that they actually care about. If you are teaching people about cyber scams, and there's no personal impact, do they really care? I like to use examples in my training that relate directly to individuals losing money, or confidential information. Now they care. You have their attention. Give them simple rules (that funny enough work in the office too!) and you've made a real dent in your cyber risk.