The Human Factor: Reimagining Cybersecurity Training

Understanding the Human Factor in Cybersecurity

The digital landscape is continuously evolving, and with it, the frequency and sophistication of cyberattacks are on the rise. This rapid development has raised significant concerns about how well organizations can withstand these threats. Despite the widespread implementation of cybersecurity awareness programs, the expected reduction in incidents—especially those involving social engineering—has not materialized as hoped.

At the heart of this ongoing vulnerability is the human factor, which has long been recognized as the weakest link in cybersecurity. While many organizations invest in awareness campaigns and mandatory e-learning modules, the reality is that simply possessing knowledge does not necessarily lead to a change in behavior.

Insights from Behavioral Research

Drawing upon behavioral psychology, particularly Social Cognitive Theory (SCT) and the Theory of Planned Behavior (TPB), research has explored what truly drives effective cybersecurity training. Using a mixed-methods approach that included expert interviews, surveys (n=163), and statistical analysis (SPSS and SmartPLS-4), the study uncovered factors that influence employee behavior in response to cyber threats.

Four key factors were identified:

• Cybersecurity skills and confidence significantly enhance employees' ability to detect and respond to threats.
• Observational learning, such as peer modeling and scenario-based role-play, reinforces secure behavior through shared experiences.
• Subjective norms, or employees’ perceptions of what others expect from them, strongly influence their cybersecurity behavior.
• Perceived behavioral control, or confidence in one’s capability to act securely, is an indicator of effective cybersecurity behavior.

Conversely, two commonly used training metrics were found to be statistically insignificant:

• Cybersecurity awareness (simply knowing that threats exist)
• Cybersecurity feedback (scores, assessments, or post-training quizzes)

These findings challenge the assumption that increased awareness or performance on a quiz automatically leads to better cyber hygiene.

Visual Summary: What Really Drives Cybersecure Behaviour

A visual representation of the findings highlights that cybersecurity behavior is most influenced by confidence, observational learning, and perceived control—not just awareness or feedback. The green bars indicate statistically significant predictors, while red ones do not. This emphasizes the need for training programs to focus on behavioral change strategies rather than mere awareness campaigns.

Implications for Cybersecurity Awareness Trainers

The data presents a compelling case; routine awareness campaigns and quizzes are no longer sufficient. For cybersecurity training to be effective, it must be designed to change behavior—not just share information.

Training coordinators should ask themselves the following questions:

• Are we enabling observational learning? Integrating real-life attack simulations, peer-led demos, and storytelling to increase retention and engagement.
• Do employees feel cyber confident, and not just aware? Using role-based, hands-on practice environments to build skill and self-efficacy.
• Are we making secure behavior the social norm? Leveraging departmental dynamics, team challenges, and recognition/reward schemes to enforce and normalize good cyber behaviors.
• Is our feedback meaningful or superficial? Moving beyond one-off quizzes and embedding continuous micro-feedback loops into daily workflows—such as phishing simulations followed by guided learning moments.

Training Strategies Recommended

To increase engagement and long-term impact, training should:

• Use behavioral modeling (live demos, scenario-based models)
• Adopt microlearning formats tailored for busy work schedules
• Leverage gamification and peer competition
• Regularly update training content to align with new threats
• Ensure visible leadership buy-ins of secure practices

A Broader Call to Action

The most important takeaway is that these findings challenge the outdated model of "tick-the-box training." Instead, they offer actionable insights for any organization or industry seeking to strengthen its cybersecurity posture. Cybersecurity training must be woven into the very fabric of an organization’s cyber strategy and maturity roadmap—not treated as a once-a-year compliance exercise.

Training should evolve into a strategic, behavioral, and cultural intervention, designed to build resilience from the inside out. Cybersecurity is not just about systems and software—it’s about people. As cyber threats change, our training must adapt accordingly.

Author's Note

These insights are based on my MSc research on cybersecurity training efficacy, where I had the opportunity to combine academic inquiry with real-world data. As cyber threats grow more human-centric, there is an urgent need to rethink how we train people—not just protect systems.