This article was originally published on not your CISO on Medium. Read the full post →
“Hey, could you please complete the security training, it was due two days ago?”
If that message sounds familiar — either as the person sending it or the one ignoring it — your security awareness program has a problem. And the problem isn’t that people are lazy or don’t care about security. The problem is that you’ve built a compliance exercise and called it a culture.
Chasing completion rates is a symptom. The disease is a training program that was designed to check a box, not to change behaviour. This post is about the difference — and how to start building something that actually works.