Technical measures prevent a lot, but not everything. A large share of successful attacks starts with a human action: a click, a sign-in, a payment. Security awareness addresses that without declaring employees a security risk.
What works
Short, regular sessions work better than one long training a year. Content should connect to the daily work of each role: accounting needs something different from development or reception. Concrete examples from your own company, such as a phishing email blocked last week, stick better than general warnings.
Phishing simulations
Simulated phishing emails show how well employees recognise attacks. They are useful when used fairly: announced as part of the programme, without exposing individuals, with an immediate explanation on click and a focus on how many people report the email, not only how many click. Data protection and employee representatives should be involved early.
Reward reporting
The key metric is not the click rate but how quickly suspicious messages are reported. Reporting a mistake immediately allows a response before damage occurs. That only works in a culture where a report earns thanks, not reproach.
Embedding
Awareness complements technical measures such as MFA and processes such as the four-eyes principle but does not replace them. For organisations under the Swiss reporting obligation, everyone must know whom to report a possible attack to immediately. Exercising the emergency is part of our cyber readiness check.