How To Manage The Human Risk In Cybersecurity

Traditional approaches to security communication are limited to perfunctory one-off training sessions that fail to take customers, regulators, and other external stakeholders into account and rarely effect long-term behavioral change. These approaches also fail to create positive feelings about the topic of security and the competence of your team and you as a leader. Unless you capture hearts and minds and demonstrate empathy with stakeholders up, down, across, and outside your organization, you will not be able to influence any change. This report lays out a four-step plan that CISOs should follow to manage the human risk. It provides design principles for creating transformational security awareness initiatives which will win the hearts and minds of senior executives, employees, the technology organization, and customers.