How To Go Beyond Security Awareness Training

For the last two decades organisations have measured the effectiveness of their security awareness program with completion rates, phishing click rates, and audit reports and evaluations. These however provide no indication of whether a particular digital behavior ultimately changes as a result of completing training or in turn reduce risky behaviours. This in turn begs the question: Why do we train people if not to change behavior and manage risk? And how are we measuring behavior change?

Flavius Plesu, the CEO of Outthink, will outline how organizations can extend the definition of security behaviors beyond phishing and incident reporting. Two decades of tired security awareness practices have created a status quo and it is time for security and risk leaders to reject commonly accepted awareness program and focus on managing the human risk. Flavius will outline what this involves including defining your behavioral baseline and target state, quantifying the human risk based on behavior, initiating risk-based interventions, and codifying security culture.