Community Digest: How to turn your October ECSM push into lasting behavior change

October is one of those times when security teams get extra executive backing, budget, and the whole company’s attention. But running a month of great campaigns is only the first step—the real challenge is making sure those habits actually carry over into the rest of the year.

That’s been the main focus for Andrew Rose in the SoSafe Community lately. As a former CSO and our first community ambassador, he uses this customer-only space to talk through how strategy works in practice, answer member questions, and share what’s helping other teams succeed right now.

Over three recent posts, he broke down how planning, listening, and measuring decide whether awareness pushes make a lasting difference or just get brushed aside. Here’s a quick recap of his main takeaways and where the conversation goes next.

1. Planning: Why great content isn’t enough on its own

Before sending out emails or launching new training, Andrew’s advice is to step back and figure out where your security culture actually stands and which habits really need fixing.

While ready-to-use campaign assets save valuable time, content alone is only half the battle. To turn those materials into real behavior change, Andrew shared a comms plan template aligned with BJ Fogg’s behavior-change model—focusing on 3 practical areas:

• Rethinking the messenger: You don’t always need the CISO delivering every update. Depending on the message, letting department heads, line managers, or trusted peers pass it on often gets much better traction.
• Policy anchors: Always tie campaign topics back to real company guidelines, so staff understand what’s expected in their day-to-day work and know where to check details.
• Behavioral levers: Tap into motivation, ability, and prompts. Instead of relying on policy warnings, focus on making safe choices effortless and nudging people right when they need to act.

Download the complete Comms Plan Template

2. Listening: Moving from broadcasting messages to two-way feedback

As Andrew puts it, counting clicks and training completions isn’t real engagement. If you want to know what’s really happening, start by asking employees a simple question: “What gets in your way when you try to report a security issue?” 

Treating the whole workforce as a single audience is another common mistake. Different teams give you feedback in completely different ways, so adapt your data collection methods::

• Executives: Skip generic surveys and schedule a direct, face-to-face conversation.
• Operational staff: Watch how they work in person to see where security rules clash with daily operational reality.
• Office workers: Look at support tickets and complaints about clunky software and process—that’s the friction driving people to take risky shortcuts.

When staff take the time to flag a suspicious email or point out a broken process, send a quick personal reply. If employee reports disappear into a void, people quickly stop trying.

Explore SoSafe’s ECSM campaign materials

3. Measuring: Proving that habits actually changed

Once October wraps up, many teams celebrate high participation numbers but still can’t answer the core question: did anyone actually change how they work?

Page views, stand visits, and completed quizzes show people were exposed to content, not that they did anything differently afterward. To prove real impact, focus on metrics tied to practical actions:

• Establish a baseline first: Pull 3 months of historical data before launching—like DLP overrides or document classification rates—so you have a realistic benchmark to compare against.
• Check back in 30 and 90 days: Higher reporting numbers in October are a good sign, but a short burst isn’t the same as long-term habit change. Re-check those same metrics one and three months out to see what actually carried over.
• Spot patterns in feedback: Track every comment, complaint, and question raised during the month. Trends in that feedback highlight where operational risks still linger.

Join the discussion in the community

Across all three posts, Andrew’s goal isn’t to hand down textbook answers. He frames these challenges as open questions, looking at what happens when campaign strategy meets real-world pressure:

• How is your team structuring its comms plan for the ECSM month every year?
• What’s worked best for getting honest feedback from your employees?
• How do you check if campaign messages actually stick once the campaign is over?

If you are a SoSafe customer, head over to the Community Best Practices space to share your experience and see how other teams are tackling these trade-offs.

Join the SoSafe Community

Login