Cybersecurity Awareness Month: what should enterprises measure first?

TL;DR: Cybersecurity Awareness Month works best as a four-week enterprise program that pairs each week with one AI-era threat, one employee behavior, and one measurable outcome, because completion alone does not show whether human risk changed, according to Adaptive Security.

Editorial analysis by NHI Mgmt Group, based on content published by Adaptive Security: “How to Run a Cybersecurity Awareness Month Campaign: A Week-by-Week Enterprise Playbook”.

Key questions

Q: What should teams do first when Cybersecurity Awareness Month has not been planned yet?

A: Start with a baseline phishing simulation, confirm the reporting channel works, and assign one executive sponsor and one communications owner.

Q: Why do awareness campaigns need verification steps for AI-era impersonation?

A: Because AI makes voice, video, and email lures more convincing, so the old assumption that a request sounds familiar is no longer enough.

Q: What are the signs that Cybersecurity Awareness Month is failing?

A: If the month produces attendance and completion numbers but no change in report rate, time to report, or retest results, the programme is signalling awareness without behaviour change.

Practitioner guidance

• Implement a before-and-after measurement model Use a baseline phishing simulation before October, then retest after the campaign and compare click rate, report rate, and time to report for each audience group.
• Design each week around one threat and one behaviour Pair AI-powered phishing, deepfake impersonation, spear phishing, and shadow AI with one clear employee action so the campaign remains focused and measurable.
• Add role-based tracks for high-risk functions Create separate content for finance, HR, executives, help desk staff, and new hires so the scenarios reflect real trust and approval workflows.

Bottom line: Cybersecurity Awareness Month is most effective when it is treated as a behaviour-change control, not a communications calendar.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →