People-Centric Cybersecurity: How to Raise Your Team's Awareness to Prevent Attacks

Cybersecurity is no longer just a technical issue: today, it is a responsibility shared by the entire company. As defense technologies have advanced, cybercriminals have begun to target the most vulnerable link in the chain: people. Social engineering techniques, such as phishing, pretexting, and baiting, exploit human behavior to circumvent technical controls and compromise entire systems.

That’s why adopting a people-centered approach is no longer an option—it’s a necessity. And it starts with education, awareness, and organizational culture. In this article, we’ll present practical strategies for training your team, real-world examples of effective campaigns, and best practices for reducing the risk of attacks that exploit the human factor.

Human Error in Cybersecurity

A firewall can be effective. Antivirus software can be kept up to date. But an unprepared team remains the biggest entry point for attacks. Studies by organizations such as IBM and Verizon show that more than 80% of data breaches involve some form of human error, whether due to negligence, carelessness, or mistake.

This scenario highlights the importance of rethinking security not just as a set of tools, but as a process that is part of the organizational culture, in which every employee understands their role in protecting the company.

What Is Social Engineering and Why Does It Work?

Social engineering is the set of techniques used by cybercriminals to manipulate people into providing confidential information, clicking on malicious links, or downloading infected files. It is based on psychology and persuasion, not on technology.

The most common types include:

• Phishing: fake emails or messages that mimic legitimate communications in order to steal credentials.
• Spear Phishing: personalized attacks targeting specific individuals within an organization.
• Pretexting: creating false scenarios (such as “IT support”) to extract data.
• Baiting: the use of false rewards to induce a click or action.
• Quid Pro Quo: promises of assistance or benefits in exchange for access.

These attacks work because they appeal to human emotions, such as fear, haste, curiosity, or the desire to help. And that’s where awareness comes in: the more trained people are, the less impact manipulation has.

Effective Strategies for Training and Internal Campaigns

Training and awareness campaigns need to be ongoing, practical, and tailored to the company’s specific circumstances. Here are some effective strategies:

1. Phishing Simulations

Create simulated phishing email campaigns. Track who clicks on the links and provide immediate feedback. This allows you to identify vulnerabilities and conduct training based on real-world scenarios.

Useful tools: KnowBe4, Cofense, Microsoft Defender Attack Simulator.

2. Gamified Training Sessions

Turning learning into a game increases engagement. Platforms with quizzes, leaderboards, and rewards make the content more engaging and memorable.

Example: Create an internal “safety league” with monthly challenges and symbolic prizes.

3. Microlearning

Avoid long, tedious training sessions. Focus on short, frequent content —3-minute videos, weekly email tips, and visual cards on internal channels.

4. Thematic Campaigns

Use events such as “Cybersecurity Month” (October) to reinforce the culture. Organize webinars, lectures, contests, and educational activities.

5. Leadership Sponsorship

When managers actively participate in campaigns, it reinforces the message that safety is a priority. Ask leaders to record videos or share their experiences.

6. Customized Training by Area

Not all departments face the same risks. Marketing, HR, and finance, for example, are more frequent targets. Tailor the content to reflect the specific challenges of each team.

See also: Incident Response: How to Plan, Test, and Learn from Cyberattack Simulations

Success Stories

Below are some real-world (and adaptable) case studies that illustrate how companies have managed to turn awareness into concrete results:

🏢 Technology Company (500 employees)

• Challenge: Recurring incidents caused by phishing.
• Solution: The company implemented monthly simulations and created a “safety scorecard.”
• Result: In six months, the click-through rate on malicious links dropped from 28% to 4%.

🏥 Health Clinic Handling Sensitive Data

• Challenge: Employees were unable to identify pretexting scams.
• Solution: training sessions featuring in-house role-playing exercises, short videos, and illustrative posters in the hallways.
• Result: a 70% improvement in the “behavioral safety” score in an internal audit.

🏛️ Public institution

• Challenge: Low participation in mandatory training sessions.
• Solution: The company adopted microlearning via its corporate WhatsApp channel and quizzes with small prizes.
• Result: a 65% increase in participation and a 40% increase in content retention.

These examples show that the key lies in consistency, creativity, and adapting to the company's profile.

Recommended Best Practices

Based on studies, international frameworks, and market experience, these are the best practices you can adopt:

✅ Focus on behavior, not just knowledge

Training sessions that merely provide information aren't enough. We need to shape behaviors, develop critical thinking skills, and establish safe habits.

✅ Various communication channels

Use emails, the intranet, corporate TV, WhatsApp, team meetings, and even promotional gifts to reinforce safety messages.

✅ Indicators and metrics

Evaluate the effectiveness of your initiatives using clear KPIs: participation rate, phishing clicks, number of incidents, and training NPS.

✅ Involve HR and Internal Communications

These areas are essential for ensuring buy-in, engagement, and alignment with the organizational culture.

✅ Keep the language accessible

Avoid technical jargon. Speak the employee’s language: real-life examples, informal language, and light-hearted humor (when appropriate).

✅ Continuously reinforce

Security isn't a one-time campaign. It should be reinforced weekly with updates and relevant content.

Conclusion

Raising awareness is more than just training—it’s about changing mindsets. It’s about helping every employee understand that they are a line of defense for the company. The more engaged, well-informed, and empowered people are, the less the organization will be exposed to threats that no technology alone can contain.

If your company hasn't started this process yet, now is the perfect time. Every day that goes by without structured measures in place is another opportunity for an attacker to exploit a human vulnerability. Learn more!

Written byCaroline Peres OrtegaMarketing Analyst — ADD IT Cloud Solutions

Responsible for the editorial content at ADD IT Cloud Solutions, he produces articles and materials on private cloud, cybersecurity, disaster recovery, and digital transformation for the Brazilian B2B market. He monitors trends in the cloud computing industry and translates complex technical topics into strategic content for IT professionals and decision-makers.

LinkedIn ↗