Introduction
What is an employee's first thought when they realise they have clicked a suspicious link? “I should tell the security team immediately” or “I hope nobody notices”? The answer is a useful starting point for understanding an organisation's security culture.
Security culture takes shape through the way employees assess risk, the behaviours managers encourage, and the extent to which business processes support secure working. An organisation's real approach is visible in its everyday decisions as well as its policy documents.
My approach centres on making security part of how an organisation operates. Alongside technical controls, this requires clear responsibilities, workable processes, and a management approach that values employees' contributions.
Main Section
1. Leadership behaviour sets the standard
Employees learn how much security matters by observing management decisions. When a manager asks someone to share an account to save time, that request can send a stronger message than the organisation's access policy.
Management support should therefore be visible through concrete actions:
- Managers should follow the organisation's security rules themselves.
- Security needs should have an allocated budget, time, and a designated owner.
- Discussions about business objectives should include the cyber risks that could affect them.
The NCSC's security culture principles also recognise leaders' role in modelling secure behaviour and building trust with employees.
For example, if an urgent project requires a security exception, the risk owner, additional safeguards, and expiry date should be clear. This shows employees how to handle urgency responsibly.
2. Make it safe and easy to report mistakes
If an employee has to complete a lengthy form or search for the right person to report a suspicious email, the reporting process needs another look.
Employees should be able to answer three questions easily:
- What should I report?
- Which channel should I use?
- What happens after I report it?
Consider an employee who has entered their password on a fake login page. Their immediate need is prompt support. The security team's first response should clearly acknowledge the report and confirm that the necessary action is underway. The investigation should also examine the process and control weaknesses that contributed to the incident.
The NCSC recommends accessible reporting channels and fair treatment of honest mistakes. This approach preserves accountability while helping employees feel able to speak up.
3. Make secure working practical
When introducing a security rule, organisations should also work out how employees will complete their tasks while following it.
Telling a team that personal file-sharing services are prohibited is insufficient if its members regularly need to share large files. They need an approved organisational service that meets their needs and provides appropriate access controls.
Similarly:
- Provide individual accounts and appropriate permissions instead of relying on password sharing.
- Establish approved channels and clear rules for sharing sensitive information.
- Explain which data employees may share when using AI tools.
If employees repeatedly try to work around a rule, review the workflow with them. The problem may lie in how the rule is understood or whether the available solution meets the team's needs.
4. Build awareness through realistic work scenarios
For annual training to influence everyday behaviour, employees need to connect it to their own work.
Useful scenarios might include supplier bank account changes for finance teams, candidate documents for human resources, and privileged access for technical teams.
For example, a finance team could discuss the following scenario:
A regular supplier emails to say that their bank account has changed. They ask you to make a payment today. What would you do next?
The aim is for employees to know the verification step they should take: confirm the change through an established contact channel, without relying on the new contact details supplied in the email.
Short scenario exercises can be repeated regularly, with clear feedback afterwards.
5. Establish ownership across departments
With coordination from the security team, each department should identify the risks and responsibilities within its own processes.
Human resources should address joiner and leaver processes, procurement should consider supplier assessments, and business teams should review the information they use and the access they need.
Appointing security contacts within departments can also improve communication. Their role is to bring their teams' needs to the security function and help put agreed decisions into everyday practice.
6. Track behavioural change alongside participation
Training completion rates provide a starting point. Assessing cultural progress requires further questions:
- How quickly do employees report suspicious activity?
- How promptly do they receive a response?
- Are processes improved after recurring incidents?
- Do employees feel comfortable asking the security team questions?
As the NCSC also highlights, an increase in reports does not necessarily indicate a deterioration in security; it may reflect greater trust in the process. Interpret the numbers alongside the nature of incidents and the time taken to report them.
Conclusion
Building a security culture requires everyday decisions that support security. Leaders who set an example, employees who feel comfortable reporting concerns, and processes that make secure behaviour practical form its foundation.
To get started, ask a few employees from different departments the same question this week: “If you realised you had clicked a link in a suspicious email, what would you do first?” If the answers are unclear, begin by clarifying the reporting channel and the steps to follow. Then use a short scenario to check that the process works in practice.
Security culture becomes tangible when employees know the right next step and feel able to take it.