Cofense Logo - Email Security Solutions

Creating a Culture of Awareness: 12 Key Practices to Follow (and Avoid)

Share Now


Developing an organization that is resilient to ever evolving email threats comes from building a strong and effective security awareness program. But how do you go about this, what does it include, and more importantly, what should you avoid? Below we’ve set out the ultimate guide featuring the top 12 practices to follow and avoid. 


Use ‘Click Rate’ as your sole measure

Click rate alone is not an effective measure of the success of an awareness program nor the resilience to a phishing attack. You cannot infer user understanding to a simulation or email threat from “no click”, it simply shows a lack of engagement.  

Rely on outdated threats 

Email threats and tactics are evolving so quickly that even traditional SEG technology alone can’t keep up.  Basing your email security training on known, previous threats won’t enable your team to be resilient against current, active threats. 

Run a corrective program  

Running a corrective program, or a program where incorrect behaviors are punished, may cause side effects such as lack of employee engagement, fear within the workplace, and lack of trust.  Use positive reinforcement to encourage the right engagement and behaviors.  

Treat employees as risks to be mitigated 

Your employees are the front line of defense in your organization. Ensure your program is set up for them to succeed and it’s not just a metric to check off the to-do list. Add in gamification to make it more enjoyable and reward desirable behaviors as it will help increase engagement and advocacy. 

Enroll a subset of employees  

Every person in the organization should be conditioned to identify and stop threats. Leaving out or only including a subset of your organization will not be effective as it only takes one person to potentially jeopardize your organization. 

Expect your Awareness Program to solve all your problems 

The reality is no matter how good your awareness program is there will always be email threats that get overlooked. You still need to arm your organization with the tools to identify those missed threats and quickly neutralize them from across your network.


Communicate your program clearly 

By clearly communicating what your email security program looks like, what you are doing, why and what you expect, you’ll create a team of security advocates. You should make sure to prioritize new hires and high target members as they will be more vulnerable. 

Develop a culture of Reporting 

Providing employees with the tools to report suspicious emails allows you to not only track the success of your awareness program, but also easily allows them to identify and react to live and incoming threats that haven’t been stopped by technology. 

Rapidly assess and respond to every reporter with a verdict 

Once you have enabled your team with a reporting function you should ensure you review each report and inform them of the outcome. This is an important step that encourages users to report more as they receive feedback regardless of the outcome. 

Train regularly 

Maintaining regular training and simulations will ensure you maintain your team’s vigilance but also the healthy behaviors and culture to protect your organization. You should also think about targeting more susceptible users with increased training.  

Try Deploying a Responsive Delivery Tactic 

By setting up your awareness program to send email simulations when a recipient is active in their mailbox, you can increase interaction rates by up to 50%. An employee’s mind is task focused during this moment so what better time to test their responsiveness and ability to spot something suspicious. 

Deliver board-level reporting 

By clearly communicating at board level the success and areas for improvement of your program, you’ll maintain the organizations overall ‘investment’ in its security. It will help to accurately direct resources, budget and improve your overall resilience ongoing.  

Cofense: Creating a Culture of Awareness Infographic
<a href="" target="_blank"><img src="" alt="Infographic: How to create a culture of awareness" /></a><br /><a href="" target="_blank">Source: Cofense</a>


We use our own and third-party cookies to enhance your experience by showing you relevant content, personalizing our communications with you, and remembering your preferences when you visit our website. We also use them to improve the overall performance of our site. You can learn more about the cookies and similar technology we use by viewing our privacy policy. By clicking ‘Accept,’ you acknowledge and consent to our use of all cookies on our website.

This site is registered on as a development site.