Measuring and improving security awareness across an IT workforce

What is shaping information technology

IT services and technology companies sell to CIOs, IT heads and business leaders through long, multi-stakeholder buying cycles where trust and proof matter.

• Buying committees are getting larger
• Thought leadership and proof points shorten sales cycles
• Win/loss evidence improves bids

An IT outsourcing company, working in Malaysia, Indonesia & Hong Kong. Client identity is withheld to protect confidentiality.

Organisation

An IT outsourcing company

Sector

Information technology

Team engaged

IT & Development

Services

Cybersecurity services, Quantitative research, Content marketing

Clients increasingly required evidence of security awareness, and a recent phishing incident had exposed gaps. Employees worked across many client accounts, and a single compromised account could affect several clients at once.

• Deliver on the brief: measuring and improving security awareness across an IT workforce.
• Design around the real needs of employees.
• Define requirements and success criteria the solution would be tested against.
• Deliver a reliable, secure solution the team can run and extend.

The work focused on 3,000 employees.

• employees3,000

Audiences we typically reach in information technology

CIOs and IT headsBusiness decision-makersProcurement teamsExisting clientsPartners and resellers

Coverage: Malaysia, Indonesia & Hong Kong. Markets: Malaysia, Indonesia and Hong Kong.

• Malaysia
• Indonesia
• Hong Kong

An iterative delivery approach: discovery, design, build and test in short cycles, with the client reviewing each step.

1. 1Brief
2. 2Baseline survey
3. 3Phishing simulations
4. 4Training content
5. 5Insight

We measured baseline awareness with a survey and phishing simulations, created short training modules in English, Malay, Bahasa Indonesia and Cantonese, and repeated simulations after training. Simulations were designed to resemble realistic threats in each market, and employees who clicked received immediate, friendly guidance rather than punishment. Results were reported by team so managers could support those who needed it most.

Cybersecurity servicesQuantitative researchContent marketing

employees

3,000

• Users and stakeholders from every affected team took part in discovery workshops and acceptance testing.

• Requirements were gathered through workshops, process walk-throughs and a review of existing systems and data.

• Peer code review on every change
• Automated and manual testing
• User-acceptance testing with the client
• Release checklist and rollback plan

• Usage and performance monitoring after launch
• Defect and support-ticket trends
• Process time before and after

• Click rates in phishing simulations fell substantially, and reporting of suspicious emails increased.

Short, local-language training changed behaviour more than annual compliance courses.

• Build on the core insight: short, local-language training changed behaviour more than annual compliance courses.
• Focus effort where the evidence was strongest: click rates in phishing simulations fell substantially, and reporting of suspicious emails increased.
• Re-measure after the changes to confirm the effect.

• The company used the results in client security reviews.
• The company also introduced a simple reporting button for suspicious emails, and reported messages helped the security team block real attacks faster.

What changed in the business as a result of the work. Impact is described qualitatively.

• Insight report and management presentation
• Cleaned data file and data tables
• Deployed solution with documentation and handover
• Support and maintenance plan

• Repeat the measure after changes are in place to track progress.
• A natural follow-on question: which campaigns generate qualified leads?