Cybersecurity Awareness and Employee Behavior: An Organizational Risk Management Framework

Most cyber incidents begin with an employee action, and organisations respond with awareness training on the assumption that knowledge changes behaviour. The evidence is mixed: trained employees still click on phishing links, particularly under time pressure. This paper develops a risk management framework in which awareness training raises security knowledge, knowledge reduces unsafe behaviour, workload raises unsafe behaviour and weakens the protective effect of knowledge, and behavioural nudges at the point of decision reduce unsafe behaviour independently of knowledge. The framework is examined in a simulation of 2,000 employees in which phishing click behaviour follows the hypothesised process. Click rates fall from 47% to 22% with training among low-workload employees but only from 80% to 44% among high-workload employees; the training–workload interaction is negative, so training is less effective where it is most needed; and nudges cut click rates from 55% to 43% across all employees. The paper argues that awareness programmes should be managed as one component of a behavioural risk system that also controls workload exposure and embeds nudges, that programme effectiveness should be measured by observed behaviour rather than training completion, and that residual human risk should be quantified and transferred to technical controls. The contribution is a framework that connects awareness to organisational risk management rather than treating it as a compliance activity.