Employees rank cyber training as the best way to boost engagement with cybersecurity efforts

Cybersecurity remains a high priority for businesses in India, but is that message getting through to employees? We asked over 1,200 of them to find out.

Our research has revealed that 61% of businesses in India suffered a data breach in the past 12 months. Unsurprisingly, we also discovered that 82% of companies have increased their investment in cybersecurity.

But protecting against cyber threats is as much about people as it is about technology. In this article, we continue to explore data from our survey of 1,264 employees in India to find out how their organisation engages them in cybersecurity. We also dive deeper into phishing attacks and their consequences, as well as the security awareness training that businesses provide to their workforce.

You can scroll down to the bottom of this article for a full methodology.

Most employees see cybersecurity training as key to engagement

Given that today’s cyberattacks often enter an organisation via an unsuspecting employee, it is vital that businesses provide their people with the skills, technology, and support to be the first line of defence.

This involves open conversations about cybersecurity between employer and employee, so that staff feel fully involved in the process. Overall, employees said that they would like to see a range of activities to help in this engagement, with training, interactive workshops, and phishing simulations all ranking highly.

The desire for more training doesn’t mean that employees don’t already receive it, however. 97% said their company provides some kind of cybersecurity or data protection training. This was most commonly around data privacy (76%), general cybersecurity (71%), or social engineering (48%).

Security awareness training is an ongoing exercise. 60% said they have refreshers every six months, and another 27% said they do training once a year. This reflects the fact that cybersecurity is constantly changing. Attackers are coming up with new threats all the time, and business practices (such as working from home) present new challenges to companies, which employees need to be aware of.

Because so many employees undergo cybersecurity training (and fairly frequently, too), employees themselves feel confident in their understanding of the cybersecurity landscape. 88% said they have a good or very good awareness of cybersecurity risks and best practices within their company.

79% of businesses have been targets of phishing attacks in the last 12 months

Criminals use phishing attacks to trick employees into handing over sensitive data. They send messages (often by email, but they can also be via social media or text message) that appear to be from a legitimate source, like a supplier or a bank. The messages may contain an attachment, which instals malicious software onto a target’s computer, or a link to a page where employees are asked to enter confidential information like passwords or bank details.

These attacks are very common. Among the people we surveyed, 79% said that they or someone in their company had received a phishing email in the past 12 months. And 76% of those said that they (or someone else in the company) clicked on a link within one of those messages.

Phishing attacks can be particularly problematic for businesses when employees’ accounts are compromised. If a hacker gains access to usernames and passwords, they can access the same files, systems, and confidential data that their victim can. And this isn’t a rare occurrence. 43% of the employees in our survey said they have experienced an account takeover in the past 12 months (where someone used a stolen username and password to access any type of online account).

The risks related to an attacker taking over an account become higher if there is more data available to them. And many employees overall report that they have access to more data than they need. Around one-fifth (21%) said employees in their company have access to all company data, and 38% said employees have access to more data than is strictly necessary to perform their job.

While the prevalence and potential risks of a phishing attack remain fairly high, companies are taking action. A majority (67%) of respondents said that their employer has carried out phishing tests in the past. These involve sending out safe emails that look like phishing attempts, and seeing how many employees are taken in.

Confidence in employers’ security measures is high

Despite the high number of data breaches, phishing attacks, and ransomware attacks, employees in our survey felt that their employers are on the right track. The majority (64%) were very confident that their company is taking cybersecurity seriously, and another 26% were quite confident.

This may stem from the fact that communication between employers and employees on these matters seems to be open and productive. Most employees (79% overall) said they have raised cybersecurity concerns with their company’s IT department, to which the companies responded in a variety of positive ways.

The usual outcomes of reporting a cybersecurity concern were further open communication between the IT department and employees, transparency about cybersecurity incidents and the measures taken to prevent them, and reminders for employees about best practices. 

Nevertheless, while using company devices, most employees (75%) said they take additional steps to protect their online safety that go above the company’s standard practices. Employers can either see this as confirmation that their own protections are insufficient or an endorsement of the fact that their staff are so well trained that they actively seek greater protection when using IT systems.

84% of companies have protocols for employees to report attacks

A majority of businesses view employees as a key way to identify and flag attacks. While it’s true that many cybersecurity software products can do this, attackers can slip through the net and remain undetected on networks for months. But if an employee spots unusual activity, or accidentally clicks a link that leads to a breach (and reports it), security experts can act quickly to shut down the attack.

The vast majority (84%) of employees in our survey said that their company has protocols in place to report an attack. And 81% said there is a formal incident response plan in place.

And as a final line of protection, many companies may choose to take out cyber insurance. These policies can often cover the cost of identifying and recovering from an attack, ransom payments, damages incurred through business closure, reputational damage, and potential costs to third parties. A majority (77%) of the respondents who are responsible for, involved in, or fully aware of company cybersecurity measures said that their firm has taken one of these policies out.

How can businesses in India engage employees in cybersecurity?

Our research has shown that employees in India are well trained on cybersecurity matters, are encouraged to participate in initiatives, and have confidence in their company’s approach.

However, the number of attacks remains high, and many simple practices (good password hygiene, restricting access to data) could be more widely adopted. And employees themselves would also like more training on cybersecurity.

By continuing to train staff about cybersecurity risks and controls —using a range of methods— companies can ensure that they’re well placed to protect their people and data against threats.