A misread email. A link clicked too quickly. An attachment opened without a second thought. That is how 95% of cybersecurity breaches begin, according to Mimecast’s 2024 State of Human Risk Report: not through a sophisticated technical exploit, but through a single moment of human inattention.
The encouraging news is that what can tip the balance in one direction can equally protect against it. Properly trained, equipped, and engaged, your employees need not be the weakest link in your security chain. They can become its most intelligent shield.
That requires giving them the means to fulfil that role and ensuring that the tools underpinning this culture of vigilance are themselves worthy of trust.
From Vulnerability to First Line of Defence
Cybercriminals do not typically try to break down your doors. They look for the one that has been left ajar, and that door is almost always a human behaviour they can exploit: phishing, social engineering, identity fraud. The path of least resistance runs through people, not machines.
For UK small businesses, the consequences are significant. The average cost of a cyberattack on a UK SME stands at £7,960, according to BT and Be the Business research, and more than a quarter of small businesses say a single attack could put them out of business entirely. The reputational damage, loss of clients, and operational disruption that follow compound those figures further still.
A purely technological response is not sufficient. The answer must also be cultural. And the results speak for themselves: organisations that implement consistent security awareness training reduce phishing susceptibility by up to 86% within a year, according to KnowBe4’s 2024 Phishing by Industry Benchmarking Report. The human lever works, provided it is used seriously and sustainably.
Building a Solid Cyber Culture: Six Levers That Make the Difference
1. Training That People Actually Want to Attend
According to KnowBe4’s research, roughly one in three employees is susceptible to a phishing attack before receiving any training. Yet annual tick-box sessions do little to change that. The solution is not compulsion but genuine engagement.
A few practical approaches that work:
- Short weekly or monthly modules of five to ten minutes, rather than infrequent marathon sessions
- Team-based quizzes and monthly challenges with a visible leaderboard
- Serious games and interactive simulations that make learning feel purposeful
- Friendly competition between departments to build collective momentum
Gamification transforms a compliance requirement into something people look forward to. Knowledge sticks, and buy-in follows naturally.
2. Phishing Simulations to Build Real Reflexes
On average, 12.3% of employees will click on a malicious link in a phishing email, according to StationX research. That is one in eight people across your organisation, today. And with AI-generated phishing now recording click-through rates more than four times higher than human-crafted messages, the threat is accelerating.
Regular internal phishing simulations allow you to train staff under realistic conditions, without real-world consequences. The goal is not to catch people out and punish them, but to create concrete, memorable learning.
After each exercise:
- Debrief clearly on the signals that should have raised suspicion
- Explain the correct response when a suspicious message is received
- Track improvement over time to demonstrate the programme’s impact
Over time, click rates fall. Vigilance rises. And when a real attack arrives, your people are ready for it.
3. Reward Good Behaviours, Not Just Penalise Mistakes
Security culture advances when it is seen as a collective source of pride rather than a constant source of pressure. A member of staff who flags a suspicious email deserves recognition, publicly. A team that goes a quarter without an incident deserves to be celebrated.
Simple gestures change the way employees relate to their role in protecting the organisation:
- A symbolic “Vigilance of the Month” award that passes between teams
- A mention in the internal newsletter highlighting a well-spotted threat
- A personal note from senior leadership acknowledging a timely alert
No financial incentive is necessary. What matters is demonstrating that security efforts are noticed and valued. Employees begin to feel invested in a shared mission rather than burdened by an imposed constraint.
4. Managers Who Embody the Culture, Not Just Relay It
A security culture does not trickle down through email circulars. It takes root when managers practise it visibly, not as a message to pass on, but as a personal habit others can observe and follow.
Concrete examples that make a real difference:
- Consistently locking screens when stepping away from a workstation
- Sharing a brief alert in team meetings about a phishing campaign currently circulating
- Putting cybersecurity on the agenda at leadership and management meetings
- Occasionally bringing in an external expert to create a positive moment of awareness
Critically, when an employee makes a mistake, the instinct must be to analyse constructively rather than to blame. A culture where people feel safe to report incidents is far more resilient than one where fear keeps errors hidden.
5. Continuous, Varied Internal Communication
One training session per year cannot keep pace with a threat landscape that shifts weekly.
Vigilance is built through repetition, variety, and consistency of messaging, effective formats include:
- Visual reminders of key security habits posted in shared spaces
- Monthly newsletters covering the latest phishing trends and real-world incidents
- Short video briefings from the IT security team shared on the intranet
- Anonymised case studies of near-misses to make risk tangible
- Tailored communications by audience: new joiners, managers, high-risk roles
The aim is to keep cybersecurity present in everyday thinking without creating fatigue. A few well-chosen minutes are worth far more than a forced hour.
6. Shared Spaces to Build a Community of Vigilance
Collective defence begins with open dialogue. When an employee can ask without hesitation, “does this email look suspicious to anyone else?”, they are protecting not only their own data but that of the entire organisation.
Dedicated internal spaces allow your teams to:
- Share alerts in real time before a threat spreads across the organisation
- Exchange best practices and learn from each other’s experiences
- Identify natural security champions within each team or department
- Build a living internal FAQ that grows more valuable over time
These informal “cyber champions” create a human defence network that no software can replicate. When looking out for each other becomes the norm, you have built something genuinely resilient.
Whaller: The Infrastructure to Make This Culture Last
Putting these levers in place is one thing. Sustaining them over time, within a genuinely secure environment, is quite another.
There is a coherence to defend here. Building a robust cybersecurity culture on tools governed by foreign legislation is working at cross purposes. The US Cloud Act and FISA allow American authorities to compel any US-based company to hand over data, wherever in the world it is stored. Contracts, certifications, and European data centres offer no protection against that legal reality.
Whaller DONJON is a French collaborative platform, SecNumCloud-qualified by ANSSI, the French national cybersecurity agency, and hosted and governed entirely in France. Your internal communications, sensitive documents, and cyber vigilance communities remain under your control, with no exposure to any foreign jurisdiction.
In practice, Whaller enables you to:
- Create dedicated cybersecurity spheres: sealed spaces for your IT security teams, cyber champions, and onboarding employees, each with its own access level
- Distribute your awareness content: guides, recorded webinars, quick-reference sheets, and quizzes, all centralised, always accessible, and targetable by role or department
- Run interactive polls and quizzes: test knowledge, track progress, and refine your programme in real time
- Build a living knowledge base: exchanges between staff and the security team naturally accumulate into a searchable internal FAQ that grows more useful over time
- Celebrate positive behaviours: a post in the activity feed to recognise a team, an alert shared instantly, a public acknowledgement that builds collective pride
Cybersecurity is everyone’s responsibility. The infrastructure supporting it should reflect that commitment, and lead by example on data protection.
Your Employees Are Your Best Cyber Defence. They Just Need the Right Tools.
No technology will fully protect an organisation whose people are not engaged. But engaged, well-trained people working on tools that do not genuinely protect their communications are only half-protected.
True cyber resilience is the convergence of human culture and technical robustness: employees who can recognise a suspicious email, and a platform that guarantees their communications will never leave without their consent. With 50% of UK businesses having experienced a cyber breach in the past 12 months, according to the UK Government’s Cyber Security Breaches Survey, waiting is no longer an option.
Whaller brings both together.
Would you like to discover how Whaller can support your organisation’s internal cybersecurity strategy? Request a demonstration.
0 Comments