Making Cybersecurity Awareness Month relevant to the whole workforce

Every October, Cybersecurity Awareness Month gives organisations a valuable opportunity to bring people together around security. Campaigns launch, posters appear and teams put considerable effort into getting employees involved. But I’ve always found the more interesting question is what happens afterwards, when everyone returns to their usual routines and has to make decisions without a reminder in front of them.

As a Senior Customer Success Manager at SoSafe, I see how challenging it can be to make awareness meaningful across an entire workforce. Organisations want to reach everyone, often with scant preparation time, but their employees have very different working lives. And understanding those differences can reveal opportunities that a centrally planned campaign might otherwise miss.

A shared message needs room for different realities

Think about someone working in finance, a colleague on a production floor and an employee travelling between customer sites. They may all encounter social engineering, but the situations they face and the ways they access information can be markedly different.

I think a good starting point is finding the right balance between central consistency, local relevance and active participation.

A central framework helps avoid piecemeal messaging and gives everyone the same security expectations. Local teams can then adapt the experience to suit their working environment. A phishing discussion might fit naturally into an office meeting, while a short visual exercise during a shift handover could be more accessible elsewhere.

A shared security standard doesn’t require everyone to learn it in the same way. Sometimes the most useful contribution a local team can make is explaining when employees are likely to encounter a risk and what might prevent them from responding as expected.

Those details help us design awareness around the way work actually happens.

We explored another approach in SoSafe’s ECSM 2026 campaign, which included short podcast episodes in both German and English. The episodes were well received and gave people another way to explore the campaign’s topics in whichever language they felt most comfortable with.

Start with situations people already understand

Some of the best opportunities to talk about cybersecurity come from mundane experiences. Most of us scan QR codes without much hesitation, whether we’re paying for parking or opening a restaurant menu. It’s a surprisingly disarming way to start a conversation about trust, because everyone can relate to the experience.

I particularly like examples that encourage people to consider their own reactions. Would they recognise a dubious request? What would make them stop and verify it? And would they feel comfortable asking someone for advice?

That last question deserves attention. We know social engineering can exploit normal human behaviour, often catching people off guard when they’re busy or trying to be helpful.  Yet people can understandably feel embarrassed about admitting they clicked a deceptive link or shared information.

The hesitation to report a mistake can become a bigger problem than the initial mistake itself. How colleagues are treated when they raise concerns influences whether they’ll feel comfortable speaking up again. Even a prompt acknowledgement that their report was useful can make a difference.

Let employees contribute to the conversation

One thing I’ve found valuable about customer-facing work is that people often tell you something you wouldn’t have thought to ask. Awareness programmes can benefit from that same openness.

Employees might suggest plausible situations for phishing simulations or share anonymised stories about scams they’ve encountered. Their observations can reveal where existing guidance feels unclear and where people have developed workarounds simply to get through their day.

There’s room for creativity here, too. An escape room or short challenge that explores an attacker’s perspective can bring colleagues together. A small activity in the canteen or a seasonal visual prompt can reach people who rarely engage with email or e-learning.

Of course, a more ambitious campaign isn’t always practical. A 5-minute conversation built around a relevant experience might give a team more to discuss than an elaborate activity.

When employees bring their own experiences into the conversation, we often discover things that would never have surfaced through a planned awareness campaign alone.

The conversation can continue at home

I also think we sometimes underestimate how personally relevant cybersecurity can be.

An employee might recognise a suspicious message because they’ve helped a parent deal with something similar. Another might take a lesson from work and use it to talk to their children about online scams. These conversations can help people become more confident digital role models in their families and communities.

A Family and Friends element gives employees a reason to connect the subject with people they care about. It can also make workplace conversations easier. Someone who feels uncomfortable discussing their own experience may be perfectly happy to share what happened to a friend.

That can open up a candid discussion about situations others may have encountered too.

Look at what happens after people participate

Completion rates are helpful for understanding how far training has reached. But they leave plenty of pertinent questions unanswered.

For example, are employees becoming more comfortable reporting suspicious activity? How quickly do they raise concerns? What do the examples they submit tell us about the risks they’re encountering?

An increase in reporting can sometimes indicate growing confidence rather than worsening security behaviour. Looking at those patterns alongside employee feedback helps us understand what’s happening.

And feedback deserves a response. When someone points out a confusing process or suggests a better example, following up shows that their contribution has been heard. It also gives us a chance to improve the next activity together.

Short on time? Start with 4 decisions

I know how quickly an awareness programme can become unwieldy when teams are trying to accommodate everyone’s needs with limited resources. A few focused decisions can make planning much more manageable:

• One relevant risk: Choose a situation employees are genuinely likely to encounter in their work.
• One relatable story: Find an example that helps people understand why someone might fall for it.
• One way to participate: Create an opportunity for colleagues to contribute an experience or explore a scenario together.
• One follow-up signal: Agree on something you’ll revisit to understand whether the activity helped.

That gives you a practical starting point, with room to develop the next activity around what people tell you.

Cybersecurity Awareness Month can bring attention to a subject that competes with many other priorities. What I value most is the opportunity it creates for better conversations between security teams and the people they’re supporting.

Some of those conversations will uncover problems. Others will bring forward ideas nobody had considered. Both are useful, and both give us something to work on together long after October.

About the author

Barbara Boino Nogueira
Senior Customer Success Manager

Barbara Boino Nogueira is a Senior Customer Success Manager at SoSafe, helping organisations strengthen their security culture and turn cybersecurity awareness into lasting behavioural change. With a background in both cybersecurity and tourism, she brings a practical, human-centred perspective to today’s digital risks.

Learn more