Recommendations

^{2024 STATE OF THE PHISH: EUROPE AND THE MIDDLE EAST \}^REPORT

Recommendations

Our survey shows that users understand their behaviour carries risk. But this often isn't enough to convince them to prioritise security. This might be for the sake of convenience, or to save time, or because they simply don’t know if IT security is their responsibility.

For users who already understand that security is their responsibility

Provide tools that empower people to be more proactive. Email reporting buttons make it simple to report suspicious messages. And “nudging” technologies such as email warning tags can prompt users to act. Also consider building a champions network and reward system to encourage these users to model best practice and advocate for others who are unsure of what to do.

For users who are unsure or don’t believe that security is their responsibility

Make education personal and relevant to individual roles and responsibilities. Increase communication from business and security leaders to better inform users of their responsibilities and their impact on the organisation.

It’s also important to provide best-in-class security education, prevention, detection and response. Advanced solutions can help balance stricter security controls with productivity by reducing the number of threats faced by users. For example, deploying an email security solution that is 99.9% effective means that most users will never have to decide how to respond to a suspicious link.

Finally, work with business stakeholders and prioritise ease-of-use when implementing security policies. Users will be less inclined to circumvent systems if security aligns with their goals. And they are more likely to use a control if it is intuitive and does not require any training.