Employees need three months’ cybersecurity training for companies to reach ‘an acceptable level of security’ according to Hornetsecurity’s new Employee Security Index (ESI) Benchmark Report.
However, a training ‘pause’ of just one month can lead to an organization’s ESI® score dropping below the level required, while a four-month hiatus can take organizations back to square one.
The report, which analysed more than 1.7 million simulated phishing attacks across 140,000 employees and over 350 businesses, sheds light on the risks that cyberattacks pose to businesses.
It revealed that 90 percent of all cyber-attacks start with phishing and more than 40 percent of all emails have the potential to pose a threat to businesses.
Daniel Hofmann, CEO of Hornetsecurity said: “The ESI Benchmark Report reveals the growing risk that phishing poses to organizations and highlights the importance of providing security awareness services to bolster their defenses.”
“The findings demonstrate that most employees can reach an acceptable level of security awareness after just three months of training. However, training must be continuous to ensure that employees are prepared against increasingly sophisticated attack methods, which often aim to exploit their blind trust in authority.”
The report also provides insights into the awareness training measures needed to optimize the security awareness of different user groups. Phishing attacks pose huge financial and reputational implications for organizations, but this scientific benchmark will help business leaders monitor the security behavior among employees and demonstrate the power of ongoing security awareness training – allowing them to create a more sustainable and robust security culture.
Continuous training is key
The report found that, on average, it takes employees three months of training to reach the ‘protection zone’. The study also indicates that ongoing training is required to ensure employees are educated and protected against developing cyber threats.
While businesses may be concerned about security fatigue, Hornetsecurity has responded to these challenges by integrating short pauses in its automated training program, its Security Awareness Service, to ensure that employees do not become disengaged.
The insights also show that security training must target individual needs rather than following a one-size-fits-all approach. The unique Awareness Engine within Hornetsecurity’s Security Awareness Service delivers automated, state-of-the-art training based on individual training needs. It also provides companies with tangible and reliable indicators and standardized comparisons between different groups of employees.
The Awareness Engine tailors the level of training to different employees depending on their ESI score. For example, if an employee has a higher click-through rate on simulated phishing scams, the organisation is aware that this individual may be less prepared against attack methods – meaning more intensive training may need to be delivered.
Hofmann continued: “We believe that prevention, protection, response and recovery are integral to business continuity, which is why we have developed our Security Awareness Service, available as a standalone solution or as part of our 365 Total Protection cybersecurity suite. It enables organisations to ensure their data stays safe through developing a sustainable security culture.”