A recent survey of 2,000 UK employees revealed some concerning gaps in cybersecurity training. According to the report, 83% of employees had not received training on deepfakes and AI, 60% had not been trained on cybersecurity while working from home, and 51% had not been educated on avoiding phishing scams.
Experts suggest that employers may be delegating cybersecurity training to IT teams, potentially due to other HR priorities. However, Martin Kraemer, a security awareness advocate, emphasized the importance of HR involvement in cybersecurity training. He believes that HR should prioritize cybersecurity training and work closely with IT departments to ensure employees are well-equipped to handle security threats.
The report also highlighted that while 42% of employees had read and signed their cybersecurity policy, 15% reported that their company did not have one. Additionally, of those who had completed cybersecurity training, some expressed challenges in following cybersecurity advice due to complexity or perceived interference with their job responsibilities.
To address these issues, experts recommend practical cybersecurity training that equips employees with the knowledge and tools to protect themselves from attacks. This includes educating employees on security threats like phishing emails and providing password management tools. Integrating training into daily roles and incentivizing participation can also enhance the effectiveness of cybersecurity education.
The survey was commissioned by KnowBe4 and conducted by OnePoll in Q2 of 2024. The findings were published in the UK Cybersecurity Practices at Work Report on 25 July.