Raising Company Employee Awareness in Information Security Based on Risk-Oriented Approach and Modern Trends

The paper considers a comprehensive approach to organizing the process of raising employee awareness in information security using a risk-oriented methodology. The relevance of the topic is associated with the growing number of incidents caused by the human factor, as well as the complication and change of cyber threats aimed at companies. The proposed approach provides for a quantitative assessment of risks, specific company business processes and priorities, the formation of individual training modules that correspond to the specifics of each company and take into account the employee access authorization matrixes. Particular attention is paid to the procedure for planning and implementing training activities, coordinating them with the company's strategy, as well as integrating training outcomes and knowledge assessment into the overall information security management system. Practical recommendations set out in the work help optimize the training process, making it more adapted to the needs of various user groups, and allow to effectively respond to new threats arising in the constantly changing digital space.