Notifications
Clear all
Topic starter
02/08/2026 12:08 pm
TL;DR: Ransomware and cyber extortion campaigns still exploit people first, not just technology, and Knowbe4’s whitepaper argues that security awareness must sit inside a defence-in-depth model rather than act as a standalone control. That matters because phishing, social engineering, and audience-specific messaging remain governance problems as much as training problems.
NHIMG editorial — based on content published by Knowbe4: Building a Security Awareness Program to Help Defend Against Cyber Extortion and Ransomware
Questions worth separating out
Q: How should organisations build security awareness programs that reduce ransomware risk?
A: Start with the behaviours most likely to interrupt the attack path, especially phishing detection, safe verification, and fast reporting.
Q: Why do awareness programs fail when ransomware attackers target human identity first?
A: They fail when training is treated as education only, not as a control that changes decisions under pressure.
Q: What breaks when security awareness is not aligned to role-specific risk?
A: A single generic campaign usually misses the lures and decisions that matter most for each audience.
Practitioner guidance
- Measure behaviour, not attendance Track phishing report rates, time-to-report, and credential submission events to see whether awareness is changing actual behaviour.
- Segment campaigns by exposure and role Create different awareness content for users who face different lure patterns, such as finance, executive support, service desk, and privileged administrators.
- Link awareness to identity controls Combine awareness with MFA enforcement, privileged access review, and rapid account containment so a successful lure does not become a durable compromise.
What's in the full article
Knowbe4's full whitepaper covers the operational detail this post intentionally leaves for the source:
- The three-part behavioural design model used to structure the awareness programme
- Audience-group content planning guidance for improving engagement across different employee populations
- Specific campaign themes around extortion tactics such as phishing and social engineering
- The whitepaper's recommended approach for strengthening the human layer of defence
👉 Read Knowbe4's whitepaper on building a security awareness program for ransomware defence →
Ransomware awareness programs: what actually changes behavior?
Explore further
02/08/2026 1:12 pm
Security awareness is a control, not a communications exercise. The article is right to frame awareness inside defence in depth, because human decision-making is part of the control surface attackers target first. Training only works when it changes reporting speed, challenge behaviour, and safe authentication habits. For IAM and PAM teams, the practical conclusion is that awareness should be evaluated like any other preventive control.
A question worth separating out:
Q: Who is accountable when compromised credentials are used to trigger ransomware?
A: Accountability usually spans identity, infrastructure, and security operations because the failure chain includes authentication design, network trust boundaries, and detection gaps. Frameworks such as NIST CSF and Zero Trust Architecture place responsibility on governance that limits blast radius, not only on the team that owns the portal.
👉 Read our full editorial: Security awareness as a control layer against ransomware and extortion
