How to Design a Better Cybersecurity Readiness Program

Mistraining and overtraining can cause cybersecurity training programs to fail. We explore the pitfalls of four common types of cybersecurity training—compliance awareness, threat simulation, specialized instruction and incident response planning. Based on insights from large accounting firms, we identify four unintended consequences—threat anxiety, security fatigue, risk passivity and cyber hesitancy—that result in adverse individual effects and organizational impacts. We recommend that organizations design a comprehensive cybersecurity readiness program using our LEAN model, which comprises four strategies: Localize, Empower, Activate and Normalize.