Employees need three months of cybersecurity training for companies to reach an acceptable level of security, according to cybersecurity provider Hornetsecurity's new Employee Security Index (ESI) Benchmark Report.
However, a training pause of just one month can lead to an organisations ESI score dropping below the level required, while a four-month hiatus can take organisations back to square one.
The ESI Benchmark Report, which analysed more than 1.7 million simulated phishing attacks across 140,000 employees and over 350 businesses, sheds light on the risks that cyberattacks pose to businesses.
It revealed that 90% of all cyber attacks start with phishing and more than 40% of all emails have the potential to pose a threat to businesses.
"The ESI Benchmark Report reveals the growing risk that phishing poses to organisations and highlights the importance of providing security awareness services to bolster their defences," says Daniel Hofmann, CEO of Hornetsecurity.
"The findings demonstrate that most employees can reach an acceptable level of security awareness after just three months of training," he says.
"However, training must be continuous to ensure that employees are prepared against increasingly sophisticated attack methods, which often aim to exploit their blind trust in authority."
Security awareness
The report also provides insights into the awareness training measures needed to optimise the security awareness of different user groups. Phishing attacks pose huge financial and reputational implications for organisations, but this scientific benchmark will help business leaders monitor the security behaviour among employees and demonstrate the power of ongoing security awareness training allowing them to create a more sustainable and robust security culture.
Continuous training is key
The ESI Benchmark Report found that, on average, it takes employees three months of training to reach the protection zone. The study also indicates that ongoing training is required to ensure employees are educated and protected against developing cyber threats.
While businesses may be concerned about security fatigue, Hornetsecurity has responded to these challenges by integrating short pauses in its automated training program, its Security Awareness Service, to ensure that employees do not become disengaged.
No one-size-fits-all
The insights also show that security training must target individual needs, rather than following a one-size-fits-all approach. The unique Awareness Engine within Hornetsecurity's Security Awareness Service delivers automated, state-of-the-art training based on individual training needs. It also provides companies with tangible and reliable indicators and standardised comparisons between different groups of employees.
The Awareness Engine tailors the level of training to different employees depending on their ESI score. For example, if an employee has a higher click-through rate on simulated phishing scams, the organisation is aware that this individual may be less prepared against attack methods - meaning more intensive training may need to be delivered.
"We believe that prevention, protection, response and recovery are integral to business continuity, which is why we have developed our Security Awareness Service, available as a standalone solution or as part of our 365 Total Protection cybersecurity suite," says Hofmann.
"It enables organisations to ensure their data stays safe through developing a sustainable security culture."
How the ESI score is calculated
Hornetsecurity's patented Spear Phishing Engine generates the phishing emails itself, automatically controlling who gets which spear phishing level and when. The simulated attacks are categorised into seven different levels of varying difficulty, meaning that users are not overwhelmed or underwhelmed during the spear phishing simulation.
An ESI score is then calculated by evaluating the number of clicks an employee makes on a simulated phishing email. This score indicates how educated they are towards different attack methods, and the results from this training allow organisations to keep their staff in shape by adopting ongoing training cycles with the help of Hornetsecurity.