COMP 6660 · Enterprise Cybersecurity Security Awareness and Human Factors

00 Introduction

Lesson 6.1 examined governance, Lesson 6.2 examined policy, Lesson 6.3 examined risk management, and Lesson 6.4 examined compliance. All four assume that people will follow the requirements, apply the controls, and make the decisions that the frameworks prescribe. This lesson examines the assumption itself — the human element on which every other control depends.

The human factor matters because people are simultaneously the most important control and the most significant vulnerability in any security programme. People detect phishing, report incidents, apply judgement in ambiguous situations, and adapt controls to operational reality. The same people are deceived by social engineering, make errors under pressure, take shortcuts when controls are inconvenient, and interpret policy in ways that suit their immediate objectives. Security programmes that ignore this reality — that assume compliance and focus only on technology — fail in ways that no technical control can prevent.

Security awareness is the discipline through which enterprises attempt to influence human behaviour. Done well, it changes what people know, what they believe, and what they do. Done badly, it produces annual compliance training that satisfies an audit, is resented by employees, and has no measurable effect on behaviour or on risk. The difference between the two is not the content — it is the understanding of human factors, the design of the programme, and the culture in which it operates.

This lesson examines security awareness and human factors in detail. It establishes why the human factor matters and what happens when it is neglected. It distinguishes awareness from training, from education, and from culture — concepts that are frequently conflated and that require different approaches. It examines cognitive factors — the biases, heuristics, and limitations that shape how people perceive risk and make decisions. It examines social engineering — the techniques through which adversaries exploit human factors, and the defences that reduce the likelihood of success. It examines security culture — what it is, how it is measured, and how it is built. It examines awareness programme design — audience segmentation, content, delivery, and cadence. It examines phishing simulation and testing — the most widely used measurement and training tool. It examines behaviour change and nudging — the techniques through which environments can be designed to make secure behaviour easier. It examines how awareness effectiveness is measured. And it closes with the pitfalls that recur across awareness programmes.

The material here builds directly on Lesson 6.2 (policy — which assumes people will follow it), Lesson 6.4 (compliance — which requires demonstrable awareness training), and the threat material in Unit 3 (social engineering and phishing). It prepares for Lesson 6.6 (auditing — which assesses whether awareness requirements are met) and for the incident response material in Lesson 6.7, where human behaviour is frequently the first detection mechanism.

01 Learning objectives

By the end of this lesson you should be able to:

These objectives contribute to Unit 6 outcomes U6.4 (auditing and assurance) and U6.5 (awareness and human factors), and to Module 3 outcomes M3.4 and M3.6. See the Unit 6 learning outcomes page for the full mapping.

02 Why the human factor matters

The human factor matters because every technical control depends on a person to configure it, operate it, monitor it, or respond to it — and because the majority of successful attacks involve a human element. Understanding why this is the case, and what follows from it, is the foundation of effective awareness.

What neglecting the human factor looks like

Failures to address the human element are recognisable, and the patterns repeat:

• Technology deployed without behaviour change. Controls that require people to act differently are deployed without support, training, or explanation — and are circumvented or ignored.
• Annual training as the entire programme. A single annual module covering the same content, unchanged year after year — producing completion records but no behavioural change.
• Phishing tests used punitively. Simulation programmes that name, shame, or discipline those who click — producing fear, concealment, and reduced reporting rather than improved awareness.
• Security as a blame culture. Incidents met with investigation and punishment rather than learning — so that people conceal mistakes and near-misses.
• Policy imposed without engagement. Requirements created without consultation with the people who must follow them, and without support for those who cannot.
• No reporting mechanism. People who notice something unusual have no clear way to report it, or believe that reporting will have no effect.
• Security seen as an obstacle. Controls that make legitimate work harder, with no compensating benefit or support — so that security is experienced as an impediment.
• Leaders who do not model. Executives who talk about security and then bypass it themselves — communicating that the requirements are for other people.
• Awareness measured by completion. Training completion rates presented as evidence of awareness — when they demonstrate only that the module was opened.
• The human factor treated as a technology problem. Attempts to solve behavioural problems with technical controls alone — producing ever more restrictive environments without addressing underlying behaviour.

03 What awareness is — and is not

Awareness is frequently conflated with training, with education, and with culture. The distinctions matter because each requires a different approach and produces a different outcome.

Awareness, training, education, and culture

The distinctions have practical consequences:

• Awareness without training produces recognition without capability. People notice something is wrong but do not know what to do about it.
• Training without awareness produces capability without attention. People can perform a task but do not notice when it is needed.
• Education without awareness produces understanding without action. People understand the concepts but do not change what they do.
• Any of the above without culture produces compliance without commitment. People follow the requirements when observed and revert to habit when not.

Common misconceptions about awareness

Characteristics of effective awareness

• Continuous rather than episodic. Awareness is sustained through regular communication, not delivered once a year.
• Relevant to the audience. Content addresses the situations the audience actually faces — not generic scenarios that do not apply.
• Actionable. Every message tells people what to do — not merely what to be concerned about.
• Positive rather than fearful. Framing that emphasises enabling safe work is more effective than framing that emphasises threat and blame.
• Reinforced by the environment. Technical controls, processes, and culture all reinforce the awareness messages — rather than contradicting them.
• Measured by behaviour, not completion. The measure is what people do, not what they have completed.
• Supported by leadership. Leaders who model the expected behaviour and who visibly prioritise security.
• Integrated with the wider programme. Awareness is one element of the security programme, connected to policy, risk, incident response, and technology.
• Continuously improved. The programme is assessed, adapted, and refined based on what works.
• Non-punitive. People who report mistakes are supported, not blamed — because concealment is a far greater risk than error.

04 Cognitive factors and human error

People do not make decisions as rational optimisers. They use heuristics, are subject to biases, respond to context, and operate under cognitive constraints. Understanding these factors is the foundation of effective awareness — because awareness programmes that do not account for how people actually think will not change what they do.

Cognitive biases relevant to security

Human error

Human error is frequently cited as the cause of security incidents. The framing is misleading — error is a normal consequence of human cognition, and the appropriate response is to design systems and processes that reduce the opportunity for error and limit its consequence.

Types of error relevant to security:

• Slips and lapses. Intended actions performed incorrectly — sending an email to the wrong recipient, clicking the wrong link, attaching the wrong file. These are automatic behaviour failures, not deliberate decisions.
• Mistakes. Actions that proceed as intended but are wrong — misjudging a situation, applying the wrong rule, making an incorrect decision. These reflect gaps in knowledge or reasoning.
• Violations. Deliberate deviations from rules or procedures — frequently well-intentioned, occasionally for convenience, sometimes habitual. These are frequently symptoms of a system that makes compliance difficult.
• Fatigue and stress. Degraded cognitive performance under pressure, time constraint, or exhaustion — reducing attention, increasing error rates, and increasing susceptibility to social engineering.
• Multitasking and interruption. Divided attention reduces vigilance and increases the likelihood of error — particularly for the recognition tasks on which security depends.

The implications for awareness:

• Do not assume rational decision-making. People make decisions under time pressure, with incomplete information, and with cognitive biases — not as optimising agents.
• Do not rely on vigilance. Sustained vigilance is not a reliable human capability. Controls should not require people to notice everything, all the time.
• Design for error tolerance. Systems and processes should be designed so that a single error does not produce a significant security outcome.
• Address the environment, not only the individual. Errors frequently reflect the conditions in which people work — time pressure, unclear guidance, unavailable tools — rather than individual failures.
• Distinguish error from violation. Error requires design improvement; violation requires understanding of why the requirement is not being followed.

The risk perception gap

People's perception of risk frequently differs from expert assessment:

• Familiar risks are underestimated. People become desensitised to risks they encounter frequently — the phishing email that arrives daily is more likely to be clicked than the one that arrives rarely.
• Dramatic risks are overestimated. Media-covered threats — particularly novel or spectacular attacks — shape perception disproportionately.
• Personal risk is underestimated. Optimism bias and the availability heuristic combine to make "it won't happen to me" a persistent belief.
• Immediate considerations dominate. The task that must be completed today outweighs the risk that may materialise eventually.
• Abstract risk does not motivate. Risk expressed as probability and impact does not motivate behaviour; risk expressed as consequence in a familiar scenario does.

Effective awareness addresses the gap directly — using concrete, relevant scenarios rather than abstract warnings, and communicating consequence in terms the audience recognises.

05 Social engineering

Social engineering is the use of psychological manipulation to persuade people to perform actions or disclose information that they would not otherwise. It is the practical exploitation of human factors — and the most common initial access technique in enterprise intrusions.

Social engineering techniques

Anatomy of a phishing attack

Most phishing attacks share a common structure:

06 Security culture

Security culture is the shared set of beliefs, values, and behaviours that determine how security is actually done in an organisation — as distinct from how it is described in policy. It is the single most consequential determinant of whether awareness translates into action.

What security culture is

Culture is what people do when no one is watching. It is shaped by what leaders reward, what the organisation celebrates, what it tolerates, and what it punishes. It is visible in the informal conversations, the shortcuts people take, and the questions people ask.

A positive security culture is characterised by:

• Security is everyone's responsibility. People understand that security is part of their job — not something the security team does to them.
• Reporting is encouraged and safe. People report suspicions, mistakes, and near-misses without fear of blame — because reporting is valued.
• Security is discussed openly. Security topics are discussed in team meetings, in project planning, and in informal conversation — not reserved for specialists.
• Leaders model expected behaviour. Executives and managers follow the same requirements they expect of others — and are seen to do so.
• Security is considered in decisions. Security is part of how decisions are made — not an afterthought or a blocker.
• Learning is prioritised over blame. Incidents are investigated for learning, not for punishment.
• Help is available. People know how to get guidance, how to report, and how to escalate — and the help is responsive.
• Compliance is normal, not exceptional. Following the rules is the default — not something that requires special effort or attracts attention.

Negative culture patterns

Measuring security culture

Culture is difficult to measure directly, but it can be assessed through indirect indicators:

• Reporting rates. The volume of security reports from employees — phishing reports, incident reports, near-miss reports. A low reporting rate is a warning sign, not a good result.
• Phishing report rates. The proportion of recipients who report a simulated phishing message. Higher reporting indicates a stronger culture.
• Time to report. How quickly people report suspicions — faster reporting indicates better awareness and confidence in the reporting process.
• Survey results. Structured surveys that ask about attitudes, perceived support, and observed behaviour — using validated instruments where possible.
• Helpdesk contact patterns. The volume and nature of security-related queries — a rise may indicate increased awareness.
• Policy exception rates. High exception rates may indicate policies that do not fit reality, or a culture where exceptions are routine.
• Incident discovery source. Whether incidents are discovered internally or externally — internal discovery indicates better detection and a stronger culture.
• Attendance and engagement. Participation in security events, training, and discussions — not merely completion, but engagement.
• Leader behaviour. Observed behaviour of leaders in relation to security requirements — the most consequential cultural indicator.

Building security culture

Culture cannot be mandated — but it can be influenced:

• Visible leadership commitment. Leaders who speak about security, model the expected behaviour, and hold themselves to the same requirements as everyone else.
• Non-punitive reporting. A clear, consistently applied commitment that people who report mistakes and near-misses will not be blamed.
• Recognition and reinforcement. Celebrating good security behaviour — the person who reported a suspicious email, the team that identified a risk — rather than only responding to failures.
• Security in the workflow. Security integrated into the tools and processes people use, rather than a separate activity that must be remembered.
• Responsive security function. A security team that answers questions promptly, is approachable, and treats the business as a partner rather than a source of risk.
• Communication that respects the audience. Security messages that are relevant, honest, and non-condescending.
• Consistency. The same requirements applied to everyone — particularly to leaders and high performers.
• Long-term investment. Culture change takes years — it requires sustained effort, not a campaign.
• Measurement and adaptation. Culture assessed through multiple indicators, and the programme adapted based on what the indicators show.

07 Awareness programme design

An awareness programme is the coordinated set of activities through which the enterprise influences what people know, believe, and do in relation to security. It requires deliberate design — not the annual purchase of a training module.

Elements of an awareness programme

The awareness programme plan

An awareness programme plan typically includes:

• Objectives. What the programme is intended to achieve — expressed in terms of behaviour, not completion.
• Audiences. The segments the programme addresses, and what each segment needs.
• Content plan. The topics covered, the formats used, and the cadence of delivery.
• Delivery channels. The channels through which content is delivered, and the role of each.
• Roles and responsibilities. Who is accountable for the programme, who develops content, who delivers it, and who measures it.
• Metrics. What will be measured, how, and at what frequency.
• Reporting. What will be reported to governance bodies, in what format, and on what cadence.
• Budget and resources. The investment required and the resources allocated.
• Review. How and when the programme will be assessed and adapted.

What works and what does not

Role-specific awareness

Different roles require different content:

• All staff. Phishing recognition, password and MFA hygiene, data handling, incident reporting, acceptable use, remote working.
• Executives and senior leaders. Whaling and business email compromise, their role in culture and governance, regulatory obligations, incident response responsibilities.
• Finance. Payment fraud, business email compromise, invoice manipulation, authority verification, dual authorisation.
• Developers and engineers. Secure coding, dependency management, secret handling, secure configuration, secure deployment.
• IT administrators and privileged users. Privileged access management, secure configuration, incident response, change management, third-party access.
• HR. Handling of personal data, recruitment fraud, social engineering targeting HR, onboarding and offboarding security.
• Legal and compliance. Privacy obligations, breach notification, regulatory requirements, third-party contracting.
• Help desk. Identity verification, social engineering through support channels, password reset procedures, escalation.
• Third parties and contractors. The requirements applicable to them, their access, their reporting obligations.

08 Content, delivery, and audience

The effectiveness of an awareness programme depends substantially on what is communicated, how it is communicated, and to whom. This section examines each in detail.

Content principles

• Relevance. Content should address the situations the audience actually faces. Generic content — the same module for everyone, covering scenarios that do not apply — is ignored.
• Actionability. Every message should tell people what to do. "Be careful with email" is not actionable; "report suspicious emails using the Report Phishing button" is.
• Conciseness. Short content is read; long content is skimmed or skipped. A single message should communicate a single idea.
• Currency. Content should reflect the threats and technologies of the moment — not the ones from three years ago.
• Positive framing. Messages that emphasise what people can do are more effective than messages that emphasise what they must fear.
• Consistency. Messages should be consistent with each other, with policy, and with the technical controls.
• Attribution. Content should come from a recognisable source — with a named author or a consistent channel — rather than appearing anonymously.
• Language. Content should be written in the language of the audience — avoiding technical jargon unless the audience is technical.
• Accuracy. Content should be accurate and current — incorrect guidance undermines credibility and can cause harm.
• Appropriate tone. Content should respect the audience — not condescend, not lecture, not blame.

Delivery methods

Audience segmentation in detail

Effective segmentation considers:

• Risk exposure. Which roles are targeted by attackers, which have access to sensitive data or systems, which make decisions with security consequence.
• Knowledge level. What the audience already knows — technical audiences require different content from non-technical audiences.
• Decision authority. Which roles can approve payments, access changes, or exceptions — and therefore require content on verification and authorisation.
• Regulatory obligations. Which roles have specific compliance obligations — for example, those handling personal data, health information, or payment card data.
• Access level. Which roles have privileged access — and therefore require content on privileged access management and accountability.
• Work context. Where and how the audience works — remote, on-site, mobile, operational — and the security considerations that arise from each.
• Language and accessibility. The languages the audience speaks and any accessibility requirements.
• Tenure. New joiners require different content from long-serving staff — and content for those who have been in role for years should not assume knowledge.

Awareness moments

Certain moments are particularly valuable for awareness:

• Onboarding. The point at which people are most receptive — and at which the organisation's expectations are established.
• Role change. When someone moves into a role with different security responsibilities — a promotion, a transfer, a new project.
• Following an incident. When attention is high and the relevance is clear — an opportunity to reinforce learning from what happened.
• Before a high-risk period. Before a peak season, a major event, or a period of organisational change — when the threat profile changes.
• Following a policy change. When new requirements are introduced and people need to understand what has changed and why.
• When new technology is deployed. When new tools or systems introduce new security considerations.
• After a phishing campaign. When a real campaign is detected — a timely reminder that the threat is real and current.
• At the point of decision. The moment at which a person is about to perform an action with security consequence.

09 Phishing simulation and testing

Phishing simulation is the most widely used awareness tool. It involves sending simulated phishing messages to employees and observing their responses — with the objective of measuring susceptibility, delivering learning at the moment of relevance, and improving recognition over time.

Why simulate phishing

• Measurement. Simulation provides a measurable indicator of susceptibility — the proportion of recipients who click, disclose credentials, or report.
• Learning at the moment of relevance. A person who clicks a simulated phishing message is highly receptive to learning about phishing at that moment — the teachable moment.
• Recognition training. Repeated exposure to realistic simulations builds recognition of the indicators that distinguish phishing from legitimate communication.
• Process testing. Simulation tests whether the reporting mechanism works, whether reports are responded to, and whether the response process is effective.
• Trend monitoring. Simulation results over time indicate whether the awareness programme is having an effect.
• Risk identification. Simulation identifies departments, roles, or individuals with higher susceptibility — informing targeted intervention.

Designing a phishing simulation programme

10 Behaviour change and nudging

Awareness programmes frequently assume that information leads to behaviour change. It does not. Behaviour is shaped by a combination of motivation, capability, and opportunity — and the most effective interventions frequently address capability and opportunity rather than motivation.

Why information is not enough

• Knowledge does not determine behaviour. People frequently know what they should do and do something else — because the correct behaviour is inconvenient, unclear, or in conflict with another objective.
• Habits dominate. Most behaviour is automatic — driven by habit and context, not by deliberate decision. Changing behaviour requires changing the context that triggers the habit.
• Intention–behaviour gap. Even when people intend to behave securely, the intention frequently does not translate into action — because the moment of decision is dominated by other considerations.
• Environment shapes behaviour. People behave differently depending on what is easy, what is visible, and what others are doing.
• Cognitive load. People have limited attention and working memory. Security requirements that add cognitive load in already-busy moments are frequently skipped.

The behaviour change model

Behaviour is a function of three elements:

Behaviour = Motivation × Capability × Opportunity

All three must be present for behaviour to occur:

• Motivation. The person must want to perform the behaviour — or at least not actively resist it. Motivation is influenced by beliefs, attitudes, and the perceived consequence of action and inaction.
• Capability. The person must be able to perform the behaviour — must know how, must have the skills, must have the time and cognitive capacity.
• Opportunity. The environment must permit the behaviour — the tools must be available, the process must support it, and the social context must not discourage it.

Awareness programmes typically address motivation — telling people why security matters. But if capability or opportunity is missing, motivation alone does not produce behaviour. The most effective interventions frequently address capability and opportunity:

• Capability: Make the secure behaviour easy to learn and easy to perform. Provide clear instructions, available tools, and time.
• Opportunity: Design the environment so that the secure behaviour is the default and the easy option — and so that insecure behaviour requires deliberate effort.

Nudging

A nudge is an intervention that influences behaviour without prohibiting options or significantly changing economic incentives. Nudges work by changing the context in which decisions are made — making the desired behaviour more likely without removing choice.

Nudge techniques relevant to security:

Designing for secure behaviour

The most effective approach to behaviour change is frequently to change the environment rather than the person:

• Make the secure option the default. Where a choice exists, the secure option should be the one that requires no action.
• Make the secure option the easy option. If the secure path takes longer or requires more steps, people will take the insecure path when under pressure.
• Make the insecure option require deliberate effort. Friction — confirmation steps, additional approval, explicit acknowledgement — reduces the likelihood of insecure behaviour.
• Provide the information at the point of decision. Guidance delivered when the person is about to make a decision is more effective than guidance delivered in the abstract.
• Reduce cognitive load. Security requirements that add complexity to an already-complex task will be skipped. Simplify.
• Make secure behaviour visible. Visible indicators — security markings on documents, security status in the UI — reinforce awareness at the moment of action.
• Design for error. Assume that people will make mistakes; design so that a single mistake does not produce a significant outcome.
• Test and iterate. The effectiveness of a nudge depends on the context — what works in one setting may not work in another. Test, measure, adjust.

Ethical considerations in nudging

Nudging raises ethical questions, particularly in employment contexts where the power relationship between employer and employee is unequal:

• Transparency. Nudges should be transparent — people should be able to understand why the environment is designed as it is.
• Choice preservation. Nudges should preserve choice — they should not eliminate options or make alternatives impossible.
• Alignment with the individual's interests. Nudges should serve the interests of the person being nudged — not only the organisation's interests.
• Proportionality. The strength of the nudge should be proportionate to the consequence of the behaviour and to the strength of the organisation's interest.
• Review and accountability. Nudges should be documented, reviewed, and subject to challenge.

11 Measuring effectiveness

Awareness programmes are frequently measured by activity — the number of training modules completed, the number of communications sent, the number of phishing simulations conducted. These measures demonstrate that the programme is operating; they do not demonstrate that it is working. Measuring effectiveness requires measuring behaviour and culture.

What to measure

Leading and lagging indicators

As with risk management, awareness measurement should include both:

• Leading indicators. Phishing report rates, time to report, engagement metrics, helpdesk contact patterns — these suggest what is likely to happen.
• Lagging indicators. Incident rates, incident severity, near-miss reports — these report what has happened.

A reporting set that includes only lagging indicators tells the organisation what happened but not what to expect. A reporting set that includes leading indicators permits intervention before failure.

Metrics in context

Metrics must be interpreted with context:

• Compare over time, not to external benchmarks. Different organisations have different contexts, different populations, and different risk profiles. Comparing to external benchmarks provides limited insight; comparing the enterprise to its own history shows whether it is improving.
• Consider the simulation design. A lower click rate on an obviously fake simulation tells you less than a higher click rate on a realistic one. The difficulty of the test affects the result.
• Consider the population. Different groups have different exposure to email, different time pressures, and different levels of security awareness. Comparing groups without understanding the context produces misleading conclusions.
• Consider the timing. A phishing simulation run during a major deadline or at a holiday period will produce different results from one run in a quieter period.
• Consider the purpose. A simulation designed for training will produce different results from one designed for measurement — because the design objectives differ.
• Avoid over-interpretation. Awareness metrics have significant measurement error. Small differences between periods or groups are frequently noise.

Reporting awareness

Awareness reporting to governance bodies should:

• Focus on behaviour and culture. Not completion rates, not activity volumes — but whether people are behaving more securely and whether the culture is supporting that behaviour.
• Include leading indicators. Report rates, time to report, and engagement — measures that suggest future performance.
• Be consistent. The same metrics, reported in the same way, at the same cadence — so that change over time is visible.
• Provide context. The numbers alone are not useful; the trend, the comparison, and the interpretation are.
• Identify what is being done. What interventions are planned or in progress — and why.
• Be honest. If the programme is not working, the board needs to know — and needs to know what will change.
• Be actionable. The board should know what decision, if any, it is being asked to make — resourcing, priorities, or strategic direction.
• Protect individuals. Never report individual results to governance — only aggregate data. Reporting individual results undermines trust and reduces reporting.

Improving based on measurement

Measurement is only valuable if it drives improvement:

• Identify what is working. Which content, channels, and approaches are producing behaviour change — and should be expanded.
• Identify what is not working. Which content is not engaging, which channels are not reaching the audience, which approaches are not producing change — and should be modified or discontinued.
• Identify high-risk groups. Which audiences have higher susceptibility or lower reporting — and may require additional support.
• Identify high-risk periods. Whether there are particular times when susceptibility is higher — and whether additional communication or controls are warranted.
• Adapt the programme. Content, cadence, channels, and approaches should be adjusted based on what the metrics show.
• Close the loop. Inform the audience of what was measured and what changed as a result — demonstrating that the programme is responsive and that their engagement matters.

12 Common pitfalls

Awareness programmes fail in predictable ways. Recognising the pitfalls accelerates improvement.

Pitfall 1 — Annual training as the entire programme

A single annual module, delivered through an e-learning platform, with the same content year after year — producing completion records and no behavioural change.

Mitigation: Build a continuous programme — regular short communications, phishing simulation, manager-led discussions, and embedded nudges. Treat annual training as one component, not the whole.

Pitfall 2 — Measuring completion rather than behaviour

Reporting training completion rates as evidence of awareness — when completion demonstrates only that the module was opened.

Mitigation: Measure behaviour — phishing reporting, click rates, incident reports, policy compliance — and culture. Report those, not completion.

Pitfall 3 — Fear-based messaging

Communication that emphasises threat, consequence, and blame — producing anxiety, disengagement, and reduced reporting.

Mitigation: Use positive framing. Emphasise what people can do, support them in doing it, and communicate that reporting is valued. Fear produces avoidance, not vigilance.

Pitfall 4 — Punitive phishing simulation

Using simulation results to identify, name, or discipline those who click — producing concealment, reduced reporting, and resentment.

Mitigation: Keep the programme non-punitive, supportive, and transparent. Report only aggregate data. Never use individual results for anything other than providing additional support.

Pitfall 5 — Generic content

The same content for everyone — covering scenarios that do not apply to most of the audience, and missing the ones that do.

Mitigation: Segment the audience. Tailor content to the situations each group actually faces. Role-specific content for high-risk roles.

Pitfall 6 — No reporting mechanism

Awareness messaging that tells people to report suspicion but provides no clear, easy mechanism — or provides one that is not responsive.

Mitigation: Implement a one-click reporting mechanism. Publicise it. Respond to every report. Close the loop with the reporter.

Pitfall 7 — Awareness disconnected from the environment

Messages that tell people to behave securely while the environment makes secure behaviour difficult — creating a contradiction that undermines the message.

Mitigation: Align the environment with the message — remove friction from secure behaviour, add friction to insecure behaviour, and make the secure option the default.

Pitfall 8 — Security function seen as unapproachable

A security team that is perceived as punitive, distant, or judgmental — so that people avoid contacting it.

Mitigation: Build relationships. Be responsive. Treat questions as opportunities, not interruptions. Make the security team approachable and supportive.

Pitfall 9 — Leadership that does not model

Executives who speak about security and then bypass the requirements themselves — communicating that the rules are for other people.

Mitigation: Engage leaders as participants, not only as sponsors. Hold them to the same requirements. Make their behaviour visible.

Pitfall 10 — Blame culture

Incidents met with investigation and punishment rather than learning — so that people conceal mistakes and near-misses.

Mitigation: Establish and communicate a non-punitive approach to error. Investigate for learning, not for blame. Celebrate reporting.

Pitfall 11 — Awareness treated as a one-off campaign

A burst of activity — a campaign, a month, an event — followed by silence. Awareness declines rapidly when it is not maintained.

Mitigation: Build a sustainable cadence. Regular, short communications. Ongoing simulation. Continuous reinforcement. Awareness is a programme, not a campaign.

Pitfall 12 — No measurement of culture

Measuring knowledge and behaviour while ignoring culture — the element that determines whether behaviour change is sustained.

Mitigation: Measure culture through surveys, reporting rates, incident discovery sources, and observed leader behaviour. Address cultural issues as part of the programme.

Pitfall 13 — Awareness as the only human-factors intervention

Attempting to address human risk through awareness alone — without changing the environment, without supporting processes, without addressing culture.

Mitigation: Treat awareness as one element of a broader approach — including process design, technical controls, environment design, and culture. Awareness alone rarely changes behaviour.

13 Key concepts

The terms below are used throughout Unit 6. Capture them in your own words as you work through the lesson.

Security awareness

The state in which people notice security-relevant situations and know what to do about them — a behavioural outcome, not a knowledge state.

Security training

Instruction that builds the skills required to perform specific security responsibilities — role-specific and capability-focused.

Security education

Instruction that builds understanding of security concepts and principles — directed at specialists who need to apply them in novel situations.

Security culture

The shared beliefs, values, and behaviours that determine how security is actually done in an organisation — as distinct from how it is described.

Human factors

The cognitive, social, and environmental factors that shape how people perceive risk, make decisions, and behave in relation to security.

Cognitive bias

A systematic pattern of deviation from rational judgement — including optimism bias, authority bias, urgency, social proof, and loss aversion — frequently exploited by social engineering.

Human error

Unintended actions or decisions that produce an undesired outcome — slips, lapses, mistakes, and violations — frequently a consequence of system design rather than individual failure.

Social engineering

The use of psychological manipulation to persuade people to perform actions or disclose information they would not otherwise.

Phishing

Deceptive communication — typically email — designed to induce a click, a credential disclosure, or an attachment opening.

Spear phishing

Phishing targeted at a specific individual, using personal or organisational detail to increase credibility.

Whaling

Phishing targeting senior executives — frequently impersonating other executives or board members.

Vishing / smishing

Social engineering conducted through voice calls (vishing) or SMS (smishing).

Pretexting

Constructing a false scenario to justify a request — an auditor, a new employee, a contractor, a regulator.

Business email compromise

Impersonating a trusted party — frequently an executive or supplier — to induce a payment or data disclosure.

MFA fatigue

Repeated push notifications or prompts until the user approves — a technique that has defeated MFA in multiple documented incidents.

Phishing simulation

Sending simulated phishing messages to employees to measure susceptibility, deliver learning at the moment of relevance, and improve recognition.

Click rate

The proportion of recipients who clicked a simulated phishing link — a commonly reported but limited measure of susceptibility.

Report rate

The proportion of recipients who reported a simulated phishing message as suspicious — a valuable indicator of awareness and culture.

Teachable moment

The moment immediately following a person's mistake or near-miss, when they are most receptive to learning — used in phishing simulation.

Security champion

An individual embedded in a team who provides local security expertise and support — extending the reach of the security function.

Behaviour change model

Behaviour = Motivation × Capability × Opportunity — a model that explains why information alone does not change behaviour.

Nudge

An intervention that influences behaviour without prohibiting options or significantly changing economic incentives — by changing the context in which decisions are made.

Default effect

The tendency of people to accept the default option — so setting the secure option as the default increases its uptake.

Friction

The effort required to perform an action — adding friction to undesirable behaviour and removing it from desirable behaviour changes what people do.

Leading indicator (awareness)

A metric that suggests future performance — phishing report rate, time to report, engagement metrics.

Lagging indicator (awareness)

A metric that reports what has happened — incident rates, incident severity, near-miss reports.

Non-punitive reporting

The principle that people who report mistakes and near-misses will not be blamed — essential for rapid detection and continuous improvement.

Security culture survey

A structured instrument that assesses attitudes, perceived support, and observed behaviour in relation to security.

Intention–behaviour gap

The divergence between what people intend to do and what they actually do — explained by the influence of context, habit, and cognitive load.

14 Activities

The activities below help you test your understanding and prepare for the unit discussion and Assignment 3. They are not graded, but completing them will substantially improve your preparation.

15 Self-check

Answer the questions below before moving to Lesson 6.6. If you cannot answer a question confidently, revisit the corresponding section.

16 Summary

This lesson has examined security awareness and human factors — the human element on which every other control depends. The essential points are:

• People are the target of most attacks and the first line of detection. Social engineering remains the most common initial access technique, and employee reporting is frequently the first indication of an incident.
• Awareness is not training. Awareness builds attention — noticing, recognising, and reporting; training builds capability — performing specific tasks correctly; education builds understanding; culture determines whether any of it translates into behaviour.
• Cognitive factors shape security behaviour. Optimism bias, authority bias, urgency, social proof, loss aversion, and other biases are routinely exploited — and awareness programmes that do not account for how people actually think will not change what they do.
• Human error is a design problem, not an individual failure. Errors reflect the interaction between people and their environment — and the appropriate response is to design systems and processes that reduce the opportunity for error and limit its consequence.
• Social engineering exploits human factors deliberately. Phishing, vishing, pretexting, business email compromise, MFA fatigue — each exploits specific cognitive tendencies, and defence requires technical controls, process controls, and awareness together.
• Security culture is the strongest determinant of behaviour. Culture is what people do when no one is watching — shaped by what leaders reward, what the organisation celebrates, what it tolerates, and what it punishes.
• Awareness programmes require deliberate design. Audience segmentation, relevant content, multiple delivery channels, a sustainable cadence, engagement, and integration with the wider programme.
• Phishing simulation is the most widely used tool — and the most frequently misused. It is valuable when non-punitive, supportive, and transparent; it is counterproductive when used to blame, name, or discipline.
• Behaviour change requires more than information. Behaviour is a function of motivation, capability, and opportunity — and the most effective interventions frequently change the environment rather than the person.
• Nudges change behaviour without removing choice. Defaults, simplification, prompts, social norms, salience, and friction — designed ethically and transparently.
• Effectiveness must be measured by behaviour and culture. Not by completion, not by activity volume — but by whether people behave differently, report suspicion, and operate in a culture that supports security.
• Common pitfalls recur. Annual training as the entire programme; measuring completion rather than behaviour; fear-based messaging; punitive phishing simulation; generic content; no reporting mechanism; awareness disconnected from the environment; unapproachable security function; leadership that does not model; blame culture; awareness as a one-off campaign; no measurement of culture; awareness as the only human-factors intervention.

These ideas prepare for the remainder of Unit 6. Lesson 6.6 examines cybersecurity auditing — the independent assessment of compliance and control effectiveness, including whether awareness requirements are met. Lessons 6.7–6.9 examine incident response, business continuity, and cyber resilience — all of which depend on the human capabilities developed through awareness and culture. Lesson 6.10 examines emerging trends, including the evolving human-factors landscape.