Su equipo se resiste a la formación en seguridad. ¿Cómo puedes hacer que sea atractivo y efectivo?

Humans have only started to write relatively recently, almost nothing compared to the learning that has taken place over the millennia in the form of stories and games or practices. This is why it is so easy for people to learn by playing or listening to stories. We learn best when we are able to attend to a story or narrative, as well as when we actively and openly practice with the content. This is why it is so important to engage people in gamification content, allowing them to learn, in a natural way, the most important lessons to protect their lives today. Cybersecurity is a necessity for everyone.

In my experience, integrating points, badges, and leaderboards can significantly boost engagement. We once implemented a system where employees earned points for completing training modules; it turned routine learning into an exciting competition.

First of all, you have to raise awareness in the organization, an first with senior management and then going through the different levels of employees, emphasizing the importance of the issue and the risk of not doing so, always highlighting that security issues will impact the organization but also the employees in their personal sphere.

Develop interactive modules with videos, animations, and interactive elements to keep the training dynamic and engaging. Include hands-on labs where employees can practice skills in a safe environment. For example, set up a mock network for penetration testing exercises. Customize training content to be relevant to different roles within the organization. For example, developers might need secure coding practices, while HR might focus on protecting employee data. Break down the training into short, digestible modules that can be completed quickly. Frequent, bite-sized learning sessions are more manageable and less overwhelming. Have leadership participate in the training to show its importance and encourage employee engagement.

Na minha opinião, tornar o treinamento de segurança envolvente e eficaz exige uma abordagem criativa que aborde as necessidades e interesses da equipe. Se fosse eu, utilizaria métodos de ensino interativos, como jogos de simulação, estudos de caso e workshops práticos, para tornar o treinamento mais atraente e memorável. Na minha experiência, teve momentos em que a personalização do conteúdo, a integração de tecnologias e a criação de um ambiente de aprendizado colaborativo ajudaram a aumentar o engajamento e a retenção do conhecimento.

In my experience, presenting case studies makes abstract concepts more tangible. We once studied the Target data breach as a case study; examining how attackers exploited vulnerabilities helped our team understand specific weaknesses and how to address them.

Something that works is applying microlearning—the avoidance of information overload. Clearly, I remember when we moved from full-day seminars to half-day sessions. Obviously, the people did retain more because it did not overwhelm them.

We've all been through the "check the box" training session. A couple of hours of one-size-fits-all training gives your team all the tools they need, right? Or are we just telling our staff that we only care for a couple hours a year? In my own experience with internal and external clients, building a continuous learning system for security awareness can have tremendous results. It doesn't have to be onerous. A quarterly phishing test, a ten minute update every month, or even highlighting a policy on the intranet now: all of these are effective.

Feedback is very relevant to understand what others feel or think about our work and the actions that are being implementing, and even more important when this feedback is continuous, because it allows you to understand, analyze and at the same time react to adjust the strategy, actions and goals in order of better results, knowing that we always have both internal and external customers and we owe to them

Every security team needs to emphasize the need for continuous learning, as security threats are dynamic and attack techniques are evolving on a day-to-day basis. In order to meet the changing tactics of cybercriminals, every team member should take up the responsibility for continuous learning. Every security awareness training program should address the need for continuous learning.

Organisations we work with see success from turning a a policy violation into an awareness moment. By interacting with users in real-time in environments where they're easy to reach, like Slack, they can deliver in-the-moment (automated) messaging to drive awareness of security policy at a one-to-one level.

My suggestion : Humor and Short Videos: Create humorous, short videos (no more than 5 minutes) featuring common security mistakes and how to avoid them. Humor makes the content more enjoyable and memorable.

For me this topic is not a question of perspectives and must be reflected in internally policies, these directives for sec trainings have to be based on external regulations and compliance. Under my view there is not too much space for interpretations or democratic styles here when we are speaking about enroll security trainings for teams. From sec office view take care about mandatory policy management and of course dont do it alone, involve and comunicate, business, compliance and all :)

As per my experience,if you really want your team to listen to you than you need to have a good personal connection with them .If you really understand and help them by addressing their problems they will willingly do any kind of task and help even the team to grow.Trainings can be made engaging but will not help overall as very few take it seriously and generally it is just for compliance.With personal connect you can engage with the team and help them understand how the training can help in one's roles and the individuals growth in organisation.