Cybersecurity is not just a technical issue, but a human one. End users are often the weakest link in the security chain, but they can also be your best protection when engaged and valuing the cybersecurity posture of your company. They may not be aware of the risks, the policies, or the best practices to protect themselves and the organization from cyber threats. They may also be reluctant to adopt new security measures, or to report incidents or suspicious activities.
We have generally moved on from the days of simply opening an email or viewing some kind of content as an instant breach and malware. While those do still happen—and it’s important for users to remain vigilant and not open suspicious emails or links—most malicious actors have pivoted to getting users to do something or give up some information to get a foothold.
It makes sense, of course, from a “return on investment” perspective for malicious actors to get users to do the hard work for them. Which is easier: developing complex code to leverage some brand-new exploit before it gets patched or getting a user to give up information?
That’s why end user engagement is crucial for cybersecurity. End user engagement means involving the end users in the security process, educating them, motivating them, and empowering them to be part of the solution. End user engagement can help to create a security culture, where everyone understands their role and responsibility, and where security is not seen as a burden, but as a benefit.
Why Would Users Do Something Risky?
Proofpoint’s 2024 State of the Phish report indicated that seventy-one percent of users took a risky action, and ninety-six percent of them knew they were doing something risky.
The follow-up question is always “why?”
In that same report, most users pointed to factors like convenience and time/cost saving. This data all suggests that users are aware that what they’re doing might be a risk, but they’re gambling that the benefits outweigh the potential ramifications.
There’s also a severe disconnect between most security professionals and the rest of the workforce. Over 85% of security professionals said that most employees know that they’re responsible for security, but over half of users either weren’t sure or claimed they were not. So, while educating your team on what risky actions might be and might look like is part of the formula, it’s also important to educate them on their part in the process and keep them rewarded and engaged for being involved.
While a comprehensive and robust security stack is critical in the current threat landscape, your end users are often going to be the deciding factor between keeping your business safe and becoming a part of a threat statistic. A DLP (Data Loss Prevention) and information protection policy doesn’t mean anything if someone is developing an HR spreadsheet on a personal machine. The best alarm system in the world doesn’t mean anything if someone gives their keys and codes to a “maintenance tech.”
How to Engage End Users in Cybersecurity
There is no one-size-fits-all approach to end user engagement in cybersecurity, but there are some general principles and strategies that can help.
- Start from the top. End user engagement should be supported and modeled by the senior management, who should communicate the importance and the value of cybersecurity to the organization and demonstrate their commitment and involvement. If senior leadership is flouting the rules and requirements, front line employees aren’t going to want to deal with them either.
- Assess the needs and the gaps. End user engagement should be based on a clear understanding of the current level of awareness, knowledge, skills, attitudes, and behaviors of the end users, as well as the challenges and the opportunities for improvement. You can’t fix what you don’t know is wrong or weak.
- Design and deliver tailored and relevant training. End user engagement should include regular and ongoing training that is customized to the specific needs, roles, and contexts of the end users, and that covers both the technical and the behavioral aspects of cybersecurity. The training should be engaging, interactive, and practical. No one wants to sit through a four-hour seminar on URL patterns.
- Provide feedback and recognition. End user engagement should involve providing feedback and recognition to the end users, both individually and collectively, on their progress and performance in cybersecurity. Feedback and recognition can help to reinforce positive behaviors, correct negative ones, and motivate and reward the end users for their efforts. The incentive for doing the harder work needs to be better than the “reward” for taking the shortcuts.
- Encourage collaboration and participation. Collaboration and participation can help to create a sense of ownership, trust, and accountability, and to leverage the collective intelligence and experience of the end users. This also minimizes people not wanting to report mistakes or issues because they’re afraid of being called out or reprimanded—which can lead a breach to fester and get even worse.
End user engagement in cybersecurity is not a one-time event, but a continuous process that requires constant monitoring, evaluation, and improvement—just like any security layer. By engaging SMB end users in cybersecurity, IT managers and security professionals can enhance the security posture of the organization and improve user experience, satisfaction, and loyalty. Sometimes there are hard choices to make between security and usability. Collaborating across your company can help people understand the why and the how rather than making every security layer feel like a punishment. Protect your security investments by making users feel like they’re part of the solution instead of finding ways to get around the solution.
Is your SMB prepared to elevate its IT security strategy to the CEO’s desk? Get started today to avoid trouble tomorrow!
