As an efficient mechanism to influence employee behavior, security culture is one of the most important, yet most overlooked, aspects of organizational security.
“A common flaw in our industry is that awareness trainings will change, i.e. improve, security behavior,” says Kai Roer, co-founder of European security startup CTLRe (and Help Net Security columnist).
“This idea comes from the rational economic theory, with which a hundred years ago economists tried to explain how people are influenced to make purchases. A few decades later, this theory was debunked by behavioral scientists, who proved that we make decisions based on emotions and social pressure, and not based on our knowledge.”
