Did you know that 63% of your employees are willing to run a ransomware within your network, voluntary?

That is a scary number! If you have 100 employees, more than half don’t know what is a ransomware nor do they have an IT security awareness whatsoever. One single email could bring your company down on its knees in few minutes if that email was to processed by one these unaware employees. They can be victims of phishing, vishing, social engineering, over-shouldering or any kind of cyber-attack without even knowing. Patching, upgrading and securing your IT network infrastructure is never enough. Employees need to be educated, aware and always caution when it comes to IT security and breaches.

Most of the time, financial decision makers don’t want to invest money on hardening the security of their company, and what makes it worst some of them think it’s not even an investment and consider it spending or even wasting time and money, without realizing that if the company got compromised they will go at least through the following:

1. Shutting the internet down. You need to cut the source.
2. Freeze the business operation.
3. Shut down some servers and workstations.
4. Hire an urgent and expensive man hours to track, troubleshoot and kill the attack.
5. Spend hours on investigating your employees.
6. And the list goes on.

This could ruin a day, a month or even years of business and company reputation, causing a financial disaster and what worse, your company may not fully recover, at least not so soon.

Understanding that spending money on educating employees about cybersecurity is actually an investment will save you, your company and even your employees from a headache, time wasting, and financial crises. You could follow different ways and options to make sure that you’re putting money in the winning spot when it comes to cybersecurity awareness:

1. Enforce security policies:
   1. Changing passwords
   2. Wear badges
   3. Use tokens
   4. Change rolls
   5. Multi-type authentications.
   6. Limit privileges and access.
   7. Harden security software and hardware.
2. Training sessions: put your employees in a periodic training sessions.
3. Keep them informed:
   1. Send them educational and informative emails about cybersecurity.
   2. Subscribe them to blogs and news that send daily, weekly or monthly updates.
4. Invest extra time and money to actually put your company system and employees under attack.
   1. Hire people to do white, black and gray hacking attacks.
   2. Try to do phishing, vishing and social engineering and check how your employees are responding.
5. Set  challenges and give rewards.
   1. Set exams for example after session and rewards the winners
   2. Test as mentioned in (4) and reward for the most caution actions and responses.
6. DO NOT PUNISH
   1. Expect the worse from your employees when it comes to Cybersecurity.
   2. Never punish for IT security mistakes that your employees are making.
   3. Educate them as much as possible.

https://www.techrepublic.com/article/survey-shows-most-workers-misunderstand-cybersecurity-how-to-improve-awareness-in-your-organization/