Human-centric cyber awareness
Human-centric cyber awareness
Why the future of cybersecurity starts with people
Organisations have invested heavily in cybersecurity awareness training. Employees complete annual courses, answer mandatory quizzes and participate in phishing simulations. Completion rates are tracked, reports are produced and compliance requirements are met.
Yet people and their decisions continue to play a significant role in cyber incidents.
This raises a difficult question: if conventional awareness training were changing behaviour effectively, would organisations still face the same human-related vulnerabilities?
The challenge is no longer a lack of awareness. Most employees understand the basic rules. They know that suspicious links require caution, passwords should be protected and unexpected requests should be verified.
The challenge is applying that knowledge during a real working day.
Cybersecurity decisions happen under pressure
Employees make decisions while managing deadlines, interruptions and competing priorities. A finance employee may receive an urgent payment request between meetings. An executive may respond to a convincing message while travelling. A customer service representative may be asked to disclose information while trying to resolve a client’s problem.
Threat actors understand these pressures. Their attacks increasingly use urgency, authority, familiarity and emotional manipulation to influence decisions.
Artificial intelligence is making these techniques easier to scale and more difficult to detect. Attackers can create convincing messages, imitate familiar communication styles and adapt social engineering attempts to specific roles or circumstances.
An employee may recognise an obvious phishing email during a training exercise. The real test comes when a fraudulent request resembles an everyday business interaction and arrives at precisely the wrong moment.
Human-Centric Cyber Awareness begins with this reality. It considers how people actually work, where pressure affects judgment and which behaviours create the greatest exposure.
Moving from completion to behaviour change
Traditional awareness programmes often concentrate on demonstrating compliance. Human-centric programmes concentrate on improving decisions.
Completion data can confirm that an employee attended training. It cannot show whether that employee will pause before processing an unusual payment, verify an unexpected request through a trusted channel or report a potential incident quickly.
A behaviour-focused programme asks different questions:
Context determines whether training feels relevant
Cyber risk does not look the same across an organisation.
Finance teams may face payment diversion, invoice fraud and executive impersonation. Developers work with source code, credentials and privileged access. Human resources teams manage sensitive employee information. Executives are more likely to encounter highly targeted social engineering. Customer-facing teams may be pressured to disclose information or bypass verification procedures.
Industry context matters as well. A healthcare organisation, manufacturer and financial institution operate under different constraints and face different consequences when systems or information are compromised.
Generic training struggles to reflect these differences. Employees are more likely to pay attention when scenarios resemble their responsibilities, systems and working environment.
Human-centric awareness aligns learning with the situations people are likely to encounter. It connects security expectations to business processes and allows employees to practise the decisions expected of them.
Four principles for a stronger awareness programme
AI is changing the cyber landscape for attackers, defenders and employees.
Threat actors can use AI to produce more convincing social engineering, research targets and generate variations of an attack. Organisations are also introducing AI into daily work, creating new questions about data sharing, verification and accountability.
Employees need to understand what information they may enter into AI tools, how to assess generated content and when human review is required. They also need to recognise that polished language, familiar branding or an apparently credible voice no longer provides reliable proof of authenticity.
Technology remains essential to cyber defence, but tools cannot make every contextual decision for the organisation. Resilience depends on technology, effective processes and people who understand their role in managing risk.
Building security behaviours that last
Cybersecurity cultures develop through consistent reinforcement. An annual course cannot address every emerging threat or establish lasting habits on its own.
Organisations should treat awareness as an ongoing capability. Training can be strengthened through shorter interventions, role-specific scenarios, timely guidance and regular opportunities to practise. Programme owners can use observed behaviour and employee feedback to refine the content.
The tone also matters. Fear can discourage people from reporting mistakes or asking for help. A constructive programme gives employees clear actions, explains why those actions matter and makes early reporting easy.
Employees should feel able to pause, verify and escalate a concern without being seen as an obstacle to the business.
The path forward
Cybersecurity has become a speed problem. AI adoption is accelerating, digital ecosystems are expanding and threats continue to evolve.
Organisations will gain little from adding more generic content to already crowded training programmes. Progress will come from understanding where human decisions create exposure and designing learning that addresses those situations directly.
The future of cyber awareness will be measured through better outcomes: employees recognising threats sooner, verifying unusual requests, protecting sensitive information and reporting concerns before they become larger incidents.
A human-centric approach meets people where they are, reflects the realities of their work and equips them to become an active layer of defence.
BDO helps organisations build stronger security behaviours through training that is practical, relevant and aligned with real business risks.
Organisations have invested heavily in cybersecurity awareness training. Employees complete annual courses, answer mandatory quizzes and participate in phishing simulations. Completion rates are tracked, reports are produced and compliance requirements are met.
Yet people and their decisions continue to play a significant role in cyber incidents.
This raises a difficult question: if conventional awareness training were changing behaviour effectively, would organisations still face the same human-related vulnerabilities?
The challenge is no longer a lack of awareness. Most employees understand the basic rules. They know that suspicious links require caution, passwords should be protected and unexpected requests should be verified.
The challenge is applying that knowledge during a real working day.
Cybersecurity decisions happen under pressure
Employees make decisions while managing deadlines, interruptions and competing priorities. A finance employee may receive an urgent payment request between meetings. An executive may respond to a convincing message while travelling. A customer service representative may be asked to disclose information while trying to resolve a client’s problem.
Threat actors understand these pressures. Their attacks increasingly use urgency, authority, familiarity and emotional manipulation to influence decisions.
Artificial intelligence is making these techniques easier to scale and more difficult to detect. Attackers can create convincing messages, imitate familiar communication styles and adapt social engineering attempts to specific roles or circumstances.
An employee may recognise an obvious phishing email during a training exercise. The real test comes when a fraudulent request resembles an everyday business interaction and arrives at precisely the wrong moment.
Human-Centric Cyber Awareness begins with this reality. It considers how people actually work, where pressure affects judgment and which behaviours create the greatest exposure.
Moving from completion to behaviour change
Traditional awareness programmes often concentrate on demonstrating compliance. Human-centric programmes concentrate on improving decisions.
Completion data can confirm that an employee attended training. It cannot show whether that employee will pause before processing an unusual payment, verify an unexpected request through a trusted channel or report a potential incident quickly.
A behaviour-focused programme asks different questions:
- Which employee behaviours create the organisation’s greatest cyber exposure?
- Where are people most likely to make risky decisions?
- Which roles face targeted or specialised threats?
- What prevents employees from reporting concerns?
- Are security habits improving over time?
- Does the training lead to better decisions during realistic scenarios?
Context determines whether training feels relevant
Cyber risk does not look the same across an organisation.
Finance teams may face payment diversion, invoice fraud and executive impersonation. Developers work with source code, credentials and privileged access. Human resources teams manage sensitive employee information. Executives are more likely to encounter highly targeted social engineering. Customer-facing teams may be pressured to disclose information or bypass verification procedures.
Industry context matters as well. A healthcare organisation, manufacturer and financial institution operate under different constraints and face different consequences when systems or information are compromised.
Generic training struggles to reflect these differences. Employees are more likely to pay attention when scenarios resemble their responsibilities, systems and working environment.
Human-centric awareness aligns learning with the situations people are likely to encounter. It connects security expectations to business processes and allows employees to practise the decisions expected of them.
Four principles for a stronger awareness programme
- Risk based: Training should focus on the threats and behaviours that create material exposure for the organisation. This requires an understanding of the threat environment, business priorities and areas where human decisions affect risk.
- Customised: Learning should reflect an employee’s role, department, access and working environment. Higher-risk groups may require more frequent reinforcement and specialised scenarios.
- Business focused: Security guidance should fit into the way work gets done. Employees need practical actions that help them reduce risk while continuing to serve customers, collaborate and make timely decisions.
- Outcome oriented: Organisations should measure changes in behaviour as well as participation. Useful indicators may include reporting habits, performance in realistic simulations, recurring knowledge gaps and the speed with which employees escalate concerns.
AI is changing the cyber landscape for attackers, defenders and employees.
Threat actors can use AI to produce more convincing social engineering, research targets and generate variations of an attack. Organisations are also introducing AI into daily work, creating new questions about data sharing, verification and accountability.
Employees need to understand what information they may enter into AI tools, how to assess generated content and when human review is required. They also need to recognise that polished language, familiar branding or an apparently credible voice no longer provides reliable proof of authenticity.
Technology remains essential to cyber defence, but tools cannot make every contextual decision for the organisation. Resilience depends on technology, effective processes and people who understand their role in managing risk.
Building security behaviours that last
Cybersecurity cultures develop through consistent reinforcement. An annual course cannot address every emerging threat or establish lasting habits on its own.
Organisations should treat awareness as an ongoing capability. Training can be strengthened through shorter interventions, role-specific scenarios, timely guidance and regular opportunities to practise. Programme owners can use observed behaviour and employee feedback to refine the content.
The tone also matters. Fear can discourage people from reporting mistakes or asking for help. A constructive programme gives employees clear actions, explains why those actions matter and makes early reporting easy.
Employees should feel able to pause, verify and escalate a concern without being seen as an obstacle to the business.
The path forward
Cybersecurity has become a speed problem. AI adoption is accelerating, digital ecosystems are expanding and threats continue to evolve.
Organisations will gain little from adding more generic content to already crowded training programmes. Progress will come from understanding where human decisions create exposure and designing learning that addresses those situations directly.
The future of cyber awareness will be measured through better outcomes: employees recognising threats sooner, verifying unusual requests, protecting sensitive information and reporting concerns before they become larger incidents.
A human-centric approach meets people where they are, reflects the realities of their work and equips them to become an active layer of defence.
BDO helps organisations build stronger security behaviours through training that is practical, relevant and aligned with real business risks.