For years, organisations have invested heavily in cybersecurity awareness training. Employees attend annual sessions, complete mandatory quizzes and participate in simulations. Completion rates are tracked, reports are produced and leadership teams gain visibility over participation.
Yet cyber incidents continue to occur, with human behaviour remaining a significant factor in many security events. This highlights an important limitation of traditional awareness programmes: providing information does not necessarily change behaviour.
Many programmes still overemphasise technology, assume that greater awareness automatically leads to safer decisions and rely on generic content with limited connection to how people actually work.
Effective cyber awareness therefore needs to focus on behaviour, not simply knowledge.
Cybersecurity is a human challenge as well as a technology challenge
Most employees know they should not click suspicious links. They understand that strong passwords matter and are familiar with warnings about social engineering. Yet people can still make decisions that expose an organisation to risk.
This is not necessarily the result of carelessness. Modern employees work in environments shaped by constant interruptions, competing priorities, information overload, hybrid working arrangements and increasingly complex digital interactions. Decisions are often made in seconds while attention is divided across multiple tasks and platforms.
Threat actors increasingly exploit these conditions. Effective cybersecurity programmes therefore need to reflect the circumstances in which real decisions are made.
Human-centric cyber awareness starts from a practical principle: people make decisions while busy, distracted and under pressure to get work done. Training needs to reflect those realities if organisations want to improve security outcomes.
From compliance to behaviour change
Traditional awareness programmes are often designed primarily to demonstrate compliance. Human-centric programmes are designed to influence behaviour.
Completion metrics can show who attended training, but they provide limited insight into whether an employee will make the right decision when faced with a convincing phishing email, a fraudulent payment request or an AI-generated social engineering attempt.
Effective awareness programmes consider how people think, what motivates them, which biases influence decision-making and where risky behaviours are most likely to occur. They apply behavioural science principles and reinforce learning continuously rather than treating awareness as a once-a-year exercise.
The objective is not to turn every employee into a security expert. It is to help people make safer decisions when it matters most.
Context matters
One of the main weaknesses of generic awareness programmes is the assumption that everyone faces the same risks. In practice, exposure varies considerably by role, function and industry.
- A finance employee processing payments faces different threats from a member of the executive team.
- A developer encounters different risks from a customer service representative.
- A healthcare organisation operates under different pressures from a manufacturer or financial institution.
Human-centric awareness recognises these differences. Training should be aligned with specific roles, business processes, industries and threat scenarios, making it more relevant, engaging and effective.
When employees recognise their own working environment in the examples presented, training becomes easier to apply. Generic content is far less likely to influence behaviour at the point when a real decision needs to be made.
A smarter approach to cyber awareness
| Approach | What it means |
|---|---|
| Risk-based | Aligned with the threats and behaviours most relevant to the organisation. |
| Customised | Tailored by role, department, industry and risk exposure. |
| Business-focused | Connected to how people make decisions in day-to-day work. |
| Outcome-oriented | Measured to identify knowledge gaps, risky behaviours and opportunities for sustained behaviour change. |
AI makes the human element even more important
The cybersecurity landscape is evolving rapidly. Artificial intelligence has lowered barriers for threat actors, accelerated social engineering capabilities and increased the potential volume and sophistication of attacks. At the same time, organisations are adopting AI internally to support efficiency, innovation and growth.
Technology remains essential to cyber defence, but the role of people becomes increasingly important as digital environments become more complex.
Cyber resilience depends on the ability to combine technology, processes and people within a coherent operating model. As cyber risk becomes more integrated with business strategy, resilience cannot be achieved through tools alone. Employees at every level need to become active participants in managing risk.
Awareness programmes therefore need to help employees recognise emerging threats, adapt to changing environments and make informed decisions in real-world situations.
Building security behaviours that last
Strong cybersecurity cultures are built through relevance rather than fear.
Employees are more likely to respond when training reflects their daily experiences, explains the consequences of specific behaviours and provides practical ways to reduce risk without unnecessarily slowing down the business.
Organisations that succeed in this area treat awareness as an ongoing capability rather than an annual event. They measure outcomes, refine content, identify higher-risk behaviours and reinforce positive security habits over time.
This approach turns cyber awareness from a compliance requirement into a business capability. It helps create a workforce that is more resilient, informed and better equipped to operate confidently in an increasingly complex digital environment.
The path forward
Cybersecurity is increasingly shaped by the speed at which organisations, technologies and threats evolve. AI is accelerating innovation, digital ecosystems are expanding and threat techniques continue to change.
Training volume and completion rates alone are therefore insufficient measures of cyber readiness. Organisations also need to understand whether employees are recognising risk and making safer decisions in practice.
Effective cyber awareness starts with understanding people.
Cybersecurity depends on decision-making, behaviour and organisational culture as much as technical controls. Programmes that reflect how people actually work can help organisations create stronger and more sustainable security behaviours.
The future of cyber awareness should be measured by better outcomes, not more content.
A human-centric approach meets people where they are, reflects the environments in which they work and helps employees become an active layer of defence.
BDO helps organisations strengthen security behaviours through cyber awareness programmes that are practical, relevant and aligned with real business risks.