Creating a Security Culture Without Creating Fear  

October is Cyber Security Awareness Month, which means plenty of reminders about how dangerous the digital world has become. Ransomware, deepfakes, state-sponsored attackers, data dumps on the dark web. All of it is real, and people should know about it. The risk is that they walk away frightened rather than prepared. 

Last month, my colleague Robbie Ross made the case that cyber risk is business risk, and that security depends on people across the whole organisation, not just IT. Building a security-aware organisation means getting all of those people on board, and fear is a poor way to do it. People who are worried about getting security wrong tend to switch off, work around the rules or keep quiet when something goes wrong. None of that makes an organisation any safer. 

A lot of it comes down to how we talk about security. Too often the message people hear is a list of things they mustn’t do, usually in an email from IT with ‘URGENT’ in the subject line. (Which, ironically, is exactly how most phishing emails start!)  

Explaining why something matters, in plain language and in the context of someone’s actual job, goes much further. A finance team that understands why a change of bank details needs a phone call to a known number will do it without being chased. One that has just been told ‘never trust emails’ will either ignore it or grind to a halt. 

Communication also has to go both ways. People need to know who to ask when something doesn’t look right, and they need to feel comfortable asking. ‘If in doubt, ask’ only works if the answer that comes back is ‘thank you’, even when it turns out to be nothing. Leaders have a big part to play here. There is no CISO or cyber expert on the planet that ‘knows it all’, and I certainly don’t. When a director admits they nearly fell for a convincing scam, it tells everyone else that being caught out is human and speaking up is expected. 

Training is where a lot of organisations fall down. The government’s latest Cyber Security Breaches Survey found that fewer than one in five businesses had trained their staff in the past year, even though phishing was still the most common attack. Training is one of the cheapest controls there is, but an annual tick-box module won’t change behaviour on its own. Most people click through it as quickly as they can and remember very little of it a week later. 

What works better is little and often, and relevant to the people in the room. Ten minutes in a regular team meeting on a recent, real example will soon add up. Sessions should be interactive and, dare I say it, enjoyable. In ours, we use games and spot-the-difference exercises, because people remember what they’ve taken part in far better than what they’ve been lectured on. Phishing simulations have their place too, as long as they’re used to learn rather than to name and shame. If yours ends with a league table of who clicked, it’s teaching people to hide, not to report. 

The aim is for security to become part of how work gets done, rather than something separate that people think about once a year. That means building it into the routines that already exist. Onboarding is a good place to start, as it sets expectations from day one. Checking a payment request by phone becomes part of the payment process rather than an extra step. Locking your screen when you leave your desk becomes as normal as locking the front door. 

It also means making the secure way the easy way. If MFA is a pain to use or the password policy is impossible to follow, people will find a way round it. A password manager, set up properly, is far easier than remembering dozens of passwords (and it’s past time we accepted we’re all terrible at passwords!). Showing people how to use one at home helps too, as the habits come into work with them. 

If you only do one thing this month, make it a conversation rather than a warning. Talk to your teams about what good looks like, make it easy for them to ask questions, and thank them when they do. 

If you’d like support with training or awareness for your team, get in touch via enquiries@oncatech.com. We’ve got your back. 

Kurtis Toy – CEO & vCISO – October 2026