Jack Salsbury, CISSP, discusses how a collaborative and open organisation can foster and encourage awareness of cyber threats, and why embedding that it’s OK to ask, it’s OK not to know and it’s OK to challenge means that everyone remains open and collective aware of what threats are out there.
Disclaimer: The views and opinions expressed in this article belong solely to the author and do not necessarily reflect those of ISC2.
“Cybersecurity awareness isn’t measured by what an employee knows. It’s measured by what they do when they don’t know”.
Most awareness programs measure whether employees can spot a threat. Few measure what they do next.
Throughout my career, I’ve often found that organizations with the most mature cybersecurity awareness programs aren’t necessarily those that deliver the most training. Instead, it’s the organizations that have embedded a culture of openness and shared responsibility. Encouraging employees to feel comfortable asking questions, admitting uncertainty and challenging things that don't feel right.
Of course, these two approaches are not mutually exclusive. Cybersecurity awareness cannot be improved through culture alone, nor can it be achieved through just training. Employees need the knowledge to recognize potential risks, but they also need the confidence to speak up when something feels wrong. The real challenge is striking the right balance between the two.
The Awareness Gap: Knowing Isn’t Always Doing
In my experience, awareness programs often focus on helping employees recognize cyber threats. Far less attention is given to what happens once an employee becomes uncertain.
Uncertainty is the gap social engineering exploits. Attackers don't need employees to be fooled, they just need them to resolve their doubt in the wrong direction. Whether that’s assuming an email is genuine, convincing ourselves a request is normal, or deciding not to ask a question for fear of looking “stupid”.
Cyber threats rarely operate in absolutes. They create doubt. It is precisely in these moments of uncertainty that awareness is put to the test.
How Organizations Respond to Uncertainty
Recognizing this challenge is one thing. Addressing it effectively is another.
The most mature organizations do not view training and culture as competing priorities. Effective training helps employees identify threats, whilst a properly developed culture influences how they respond during uncertainty.
Within my own organization, one of the biggest challenges wasn't helping people identify potential threats. It was ensuring they felt comfortable doing something when they weren't sure.
A pattern started emerging. Employees would forward suspicious emails or messages to us, but almost always with a caveat.
- “It’s probably nothing, but…”
- “Sorry to bother you…”
- “I think it’s legit, but I thought I’d check…”
What stood out was that there were often two forms of uncertainty at play: uncertainty about the legitimacy of the request itself and uncertainty about whether it was worth reporting in the first place.
Most of our team were worried about wasting someone’s time if their concerns were unfounded. In reality, those interactions represented exactly the type of behavior that we needed to encourage. I’d always rather review ten legitimate emails than miss one malicious one because somebody felt uncomfortable asking the question.
Over time, we worked hard to reinforce that message. There was no criticism, no embarrassment and no expectation that employees should have all the answers. Instead, we encouraged people to treat cybersecurity as a team sport.
When someone reports a suspicious email, questions an unusual request, or seeks a second opinion before sharing information, they are contributing to the organization’s collective defense.
Over time, I started noticing a change. People became more willing to ask the question, challenge the request, or seek a second opinion before acting. Those small moments of collaboration often provide the greatest opportunity to prevent a cyber incident before it occurs.
Learning Through Experience
One of the most valuable lessons we learned about the importance of collaboration came following a sophisticated phishing-related account compromise.
Like many organizations, we had invested in awareness training, technical controls and had established security processes. Despite these measures, a convincing phishing attack succeeded.
The challenge now was deciding what happened next. We could either treat the incident in isolation or use it as an opportunity to improve organizational awareness. We chose the latter.
It’s easy to focus on the individual and the actions that led to the compromise. After the incident was contained and went through our full incident response process, we used this as an opportunity for collective learning. Everyone wanted to know how it happened. We explained how the attack worked, the techniques that had been used and why the phishing email had appeared legitimate.
Most importantly, the conversation was never about blame. Our message was simple: this could have happened to anyone.
What followed was one of the most positive awareness outcomes I’ve ever experienced. Colleagues became more engaged in discussions around cyber risks, reporting of suspicious activity had increased and they were more willing to seek a second opinion when something felt off.
What struck me most was how many conversations that incident generated afterwards. People were talking about phishing emails, sharing examples and asking questions. The learning extended far beyond the colleague who had been targeted.
From Compliance to Conversation
While incidents can provide powerful learning opportunities, they are not something any organization wants to rely on as an awareness strategy.
One of the ongoing challenges I've faced is maintaining engagement once employees have completed their mandatory awareness training. Awareness can quickly become associated with annual refresher modules rather than the day-to-day decisions employees make throughout their working lives.
I realized that if awareness only appeared during annual training, I had already lost the battle. I needed people talking about security throughout the year, not just when a training reminder came through. We've focused on introducing awareness activities that create small moments of curiosity and discussion within employees' everyday routines. This might be as simple as placing scenario cards around the office for people to discover throughout the day.
While traditional training has its place, engagement often drops when awareness is seen as something separate from the job itself. By contrast, these informal activities encourage discussion in the moment, amongst colleagues and within the context of their normal working environment.
In many ways, the scenarios themselves became secondary. The real value came from creating opportunities for employees to discuss uncertainty openly and collaboratively. Colleagues challenged each other's thinking, shared different perspectives and worked through situations together. Those conversations often provided more insight than the "correct" answer ever could.
Awareness is Measured in Moments of Uncertainty
Effective awareness programs are not defined solely by training completion rates, phishing simulation results, or policy acknowledgments. They are important considerations, but they only tell part of the story.
The real measure of awareness is what happens in the moments where certainty becomes blurred.
Creating this culture is not easy. It requires trust, openness and a willingness to accept that employees won’t always have the answers.
When employees know it is OK to ask, OK not to know and OK to challenge, cybersecurity awareness becomes something more powerful than a training program. It becomes a behavior, a mindset and ultimately part of the organization’s culture.
In a collaborative organization, awareness is no longer owned by the security team alone. It is strengthened through daily conversations, shared experiences and collective responsibility.
After all, cybersecurity awareness isn't measured by what an employee knows. It's measured by what they do when they don't know.
Jack Salsbury, CISSP, is a cybersecurity and information security leader with experience spanning IT strategy, data protection and risk management. He has held both hands-on technical roles and senior leadership positions, with accountability for building security programs that align with organizational goals while remaining practical to deliver.
