Rethinking Human Cyber Risk: How CISOs can transform security awareness training to drive measurable risk reduction

It’s time to rethink security awareness

Most organisations are doing everything they’re supposed to. Security awareness training is delivered, campaigns are running, and phishing simulations are in place. 

But when incidents happen, the same patterns keep appearing: employees clicking convincing phishing emails, sharing sensitive data in the wrong place, or falling for impersonation attempts that feel completely legitimate. The problem isn’t effort, it’s the model. 

This research report, based on insights from 200 CISOs across Europe, explores why traditional security awareness programmes are falling short, and what needs to change to actually reduce human cyber risk.