October and Cybersecurity Awareness Month are at an end for another year. We look back at the advice and experiences shared by ISC2 members, along with our video campaign highlighting the role of cybersecurity professionals in keeping everyday life secured and uninterrupted.
As Cybersecurity Awareness Month draws to a close, one message has emerged particularly strongly from the experiences shared by ISC2 members: cybersecurity awareness cannot be confined to the security team, an annual training module or a single month in the calendar.
Throughout October, our Everyday Life. Secured. campaign highlighted the often unseen role cybersecurity professionals play in protecting the digital services and experiences on which people and organizations depend. From purchasing and travel to healthcare, finance and communications, cybersecurity underpins the trust that allows everyday digital life to function.
Our contributors have challenged the idea that annual training alone creates a security-conscious organisation. Awareness must translate into everyday behaviour, reinforced by managers, supported by a culture where people are comfortable asking questions and challenging decisions, and designed around the moments when people actually encounter risk.
We have also learned that preparing people for cybersecurity incidents means considering the human response to pressure. Recognising a potential attack is important, but so is knowing how to react calmly and appropriately when something has gone wrong. Attackers understand human behaviour too, exploiting urgency and other psychological triggers to encourage people to act before they think.
At the same time, the boundaries of cybersecurity awareness are changing. AI agents introduce behaviours and risks that traditional human-centred awareness programmes were never designed to address. AI acceptable-use policies are only part of the answer, requiring organisations to connect awareness with governance, controls, monitoring and secure alternatives. Nor should awareness necessarily stop with employees. Customers and others interacting with an organisation can also play a role in the wider security environment.
Perhaps most importantly, ISC2 members have reminded everyone what all this activity ultimately protects. Cybersecurity creates the assurance and confidence that allows organisations and individuals to use technology, make decisions and manage risk.
Cybersecurity Awareness Month may be ending, but awareness itself cannot be seasonal. The challenge is to turn what we know into everyday actions that make our organisations, customers and wider society more secure.
To help with that, we’ve collected all the articles and videos published across the month into one place for you to refer to and share:
Videos
Articles
Why Everyone Needs Awareness of Cybersecurity Issues
As cybersecurity threats continue to evolve in sophistication and scale, organizations must recognize that cybersecurity awareness is not simply a training exercise. It is an imperative that requires participation from across the enterprise.
Does This Make Sense? Rethinking Cybersecurity Awareness
Llewellyn Willemse, CISSP shares his experiences and thoughts on rethinking organizational approaches towards awareness of cybersecurity issues – both technical and nontechnical.
The Training Nobody Remembers: What Actually Changes Security Behavior
Marie Wang, CISSP, CC shares her experiences of how training and awareness can successfully resonate with the organization to improve cybersecurity readiness, as well as the challenges when it doesn’t.
Calm in the Chaos: What Skydiving Taught Me About Cybersecurity
Ernest Blankson, CISSP, CGRC, discusses an often-overlooked dimension of cybersecurity awareness and incident response: human performance under pressure. Employees are frequently taught how to recognize phishing messages and other warning signs, but organizations spend less time preparing them to manage their initial reactions after they believe an incident may have occurred.
Your Awareness Program Trains Humans Not to Click, Nobody Trains the Agent
Security awareness programs are built on assumed behavior. But as Nik Kale, CISSP, explains, the rise of AI agents has significantly altered the realities of operational behavior and process, because AI-based activity doesn’t always mimic the actions we expect from real people.
Cybersecurity Awareness Is Not a Training Problem, It’s a Management Problem
Larry Marks, CISSP argues that many organizations still treat cybersecurity awareness as an annual training exercise. But awareness only becomes effective when managers reinforce it through day-to-day decisions, escalation expectations, reporting and accountability.
How A Collaborative Organization Fosters Greater Cybersecurity Awareness
Jack Salsbury, CISSP, discusses how a collaborative and open organization can foster and encourage awareness of cyber threats, and why embedding that it’s OK to ask, it’s OK not to know and it’s OK to challenge means that everyone remains open and collective aware of what threats are out there.
Cybersecurity Awareness at the Moment of Risk
Pooyan Hamidi, CISSP, CCSP shares what data protection and artificial intelligence adoption taught him about designing security at the decision point.
Why Urgency Works: The Psychology Behind Our Most Effective Attack Vector
Jennifer Blacker, CISSP, discusses the essential value of urgency to an attacker and the phycological strategy behind the use of urgency to sidestep the cybersecurity awareness training so many have been through.
AI: The Good, the Bad and the Ugly
As AI becomes increasingly bought, built and embedded across the enterprise landscape, organizations must confront familiar human-factor challenges alongside newer concerns around accuracy, security, compliance, unintended actions and governance, as Kristopher Persad, CISSP, CGRC, CC explains.
AI Acceptable Use Policies Are Not Enough: Turning AI Awareness into Operational Security
Renato Salvadori, CISSP, shares his views on why AI acceptable use policies and awareness alone are not sufficient to address shadow AI, and how organizations can connect governance, data classification, technical controls, monitoring and secure alternatives to turn AI awareness into operational security.
Your Customers Need Security Awareness Too
Every October, the inbox of Mark Sayewich, CISSP, fills up with the same thing yours probably does: phishing-simulation results and password-hygiene reminders. His organization runs a whole awareness season for employees and it's a good habit to have. However, almost nobody runs the same thing for customers.
Beyond Hackers and Scams: What Does Cybersecurity Really Protect?
For Rimple Kapil, CISSP, CCSP, cybersecurity is not only about stopping something bad from happening. It is also about helping an organization understand what could happen, what matters most, what controls are appropriate and whether the remaining risk is understood. In other words, a large part of cybersecurity is about assurance and confidence.
.png?h=420&iar=0&w=420)
.png?h=420&iar=0&w=420)
