PITTSBURGH, PA – A new survey by cybersecurity provider Hornetsecurity has uncovered significant gaps in IT security training, with a quarter (26%) of organizations still providing no form of training to their end users.
The survey, which compiled feedback from industry professionals around the world, also reveals that fewer than one in 13 (8%) organizations offer adaptive training that evolves based on the results of regular security tests. In a rapidly evolving cybersecurity landscape, where malicious threat actors are constantly devising new ways to infiltrate and harm, this is a significant business concern.
Engagement and Effectiveness in Training
People represent the frontline of every company’s cybersecurity strategy. The most popular type of cyberattack is phishing, which preys on a person’s trust. Employees must therefore be equipped with the skills, understanding and confidence to spot malicious behaviors. Sadly, Hornetsecurity’s survey revealed that not only is there a significant gap in training, but training initiatives are seen to be ineffective. Nearly a third (31%) of respondents reported that their training was unengaging or only slightly engaging.
Despite the low engagement levels, 79% of organizations believe their IT security awareness training to be at least moderately effective in combating cyber threats. However, nearly four in ten (39%) reported that the training does not cover recent or AI-powered cyber threats adequately. In a world where AI is expediting and increasing the scale of attacks, this is alarming.
Daniel Blank, COO of Hornetsecurity, said, “Our latest research shows a clear disconnect between the perceived effectiveness of security training and its actual relevance and responsiveness to modern cyber threats, especially the recent boom in AI-driven attacks. Employees must be equipped with ongoing training to bolster any technical defenses and serve as a human firewall. The ongoing aspect is essential for the training to have the most impact. It’s important to invest in the latest cybersecurity technology, but a sustainable security culture means investing in people as well.”
Post-incident Adaptations and Reporting Gaps
The survey found that one in four organizations had suffered a cybersecurity breach or incident, 23% of which had occurred in the last year. Notably, 94% of these organizations took steps to strengthen their security by implementing additional controls post incident. Yet, despite these efforts, 52% of respondents noted that end-users often ignore or delete identified email threats without reporting them, and 38% forget the training content, showing the need for ongoing and engaging training enhancements.
Survey results showed many companies suffered breaches recently.
The survey highlighted that people are particularly interested in more effective post-training resources, which could help in retaining and applying the learned security measures. Another area for improvement is feedback on reported threats, with 28% stating the lack of feedback as a reason for not adhering to training protocols.
Need for Updated Training
A significant 45% of decision makers in IT believe their current training programs are outdated and ineffective against AI-powered attacks. This sentiment is echoed by 39% of general respondents, showing a critical need for training content that is both current and comprehensive.
Blank added, “It’s imperative that organizations not only provide regular, engaging, and adaptive training but also ensure that these programs thoroughly address the latest and most sophisticated cyber threats. This is why we developed Hornetsecurity Security Awareness Service, a next-gen solution that delivers the right amount of training customized per employee in an automated way. That way, organizations can provide the right level of ongoing training without draining IT resources to set this up and deliver it.”
There’s a significant gap in cybersecurity training, survey results showed.
He stressed: “Proactivity is key: instead of strengthening after incidents, organizations should pre-empt attacks and have robust systems and processes in place. Doing so saves significant time, effort and cost.”
Cyber Insurance and Preventative Measures
Over half of the surveyed organizations (56%) now use cyber insurance, indicating a growing reliance on financial safeguards against cyber incidents. Additionally, 79% of organizations attribute the prevention of cybersecurity incidents directly to their IT security training programs, while 92% acknowledge that the training has enabled end-users to spot security threats across various media, not just email.
About Hornetsecurity
Hornetsecurity is a leading global provider of next-generation cloud-based security, compliance, backup, and security awareness solutions that help companies and organizations of all sizes around the world. Its flagship product, 365 Total Protection, is the most comprehensive cloud security solution for Microsoft 365 on the market. Driven by innovation and cybersecurity excellence, Hornetsecurity is building a safer digital future and sustainable security cultures with its award-winning portfolio. Hornetsecurity operates in more than 120 countries through its international distribution network of 12,000+ channel partners and MSPs. Its premium services are used by more than 75,000 customers.
