Security awareness training often fails because people forget it by the following week. A real security culture is different. It shows up in everyday decisions: someone pausing before approving a payment, or reporting a strange message without worrying about looking foolish.

Culture cannot be installed like software, but it can be built deliberately.

Make it short and relevant

Five minutes of relevant training beats an annual hour-long video. Tailor examples to each team: finance needs to recognise invoice fraud, developers need secure coding habits, and executive assistants are frequent targets of impersonation.

Use real examples from your own organisation where you can. A phishing message that actually reached your staff is far more memorable than a generic slide.

Reward reporting

People who report mistakes quickly are your best early warning system. Thank them publicly, and never punish an honest error. If somebody fears getting into trouble for clicking a link, they will stay quiet, and the attacker gains hours or even days.

The most dangerous phishing click is the one nobody reports.

Make reporting effortless with a single button in the email client, and always tell people what happened as a result. Feedback shows that speaking up made a difference.

Make the secure path the easy path

When security gets in the way of work, people find workarounds. Good design removes the conflict altogether.

• Use single sign-on and passkeys in place of many passwords

• Provide approved tools for sharing files and using AI

• Keep policies short and written in plain language

• Offer a quick way to ask the security team a question

Lead from the top

Staff notice what leaders do, not only what they say. If executives demand exceptions to MFA, everyone else learns that security is optional. Ask leaders to follow the same rules and to talk openly about why they matter.

Security champions help too. A volunteer in each team can answer everyday questions, share concerns and keep security connected to how the work really gets done.

Measure what matters

Click rates alone can be misleading, because they depend on how difficult the test was. Track how many people report suspicious messages and how quickly they do so. A rising report rate is one of the clearest signs that your culture is improving.