Topic starter
02/08/2026 12:08 pm
TL;DR: Ransomware and cyber extortion still work through human trust, Knowbe4 says in its whitepaper, so security awareness belongs inside defence in depth. That makes reporting, behaviour change, and access monitoring part of the same control picture.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper: Building a Security Awareness Program to Help Defend Against Cyber Extortion and Ransomware”.
Key questions
Q: Why do phishing and credential stuffing still matter in ransomware cases?
A: They remain effective because ransomware affiliates exploit identity weaknesses at scale.
Q: What are the signs that an awareness programme is failing?
A: The clearest signs are repeated user interaction with suspicious messages, weak reporting rates, low follow-through on simulations, and recurring incidents that begin with the same social engineering pattern.
Q: What breaks when security awareness is treated as a standalone ransomware control?
A: It breaks at the human decision point.
Practitioner guidance
- Map awareness content to attack paths Build role-based modules for finance, executives, service desk, and general staff so the examples match the requests each group actually receives.
- Tie simulations to reporting behaviour Measure whether users report suspicious messages quickly and consistently, rather than only tracking click rates or completion percentages.
- Connect awareness to identity controls When users fail simulations or report suspicious activity, link the event to authentication hardening, session review, and account monitoring.
Bottom line: Ransomware and extortion campaigns still depend on human trust, so awareness is best treated as a control layer that supports defence in depth.
Glossary terms: Security Awareness Programme, Defense in depth, Human Defence Layer, Phishing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:12 pm
Security awareness is a compensating control for human trust, not a standalone defence. The article is right to reject the idea that technology alone can stop ransomware and extortion. These campaigns still rely on people making one bad trust decision, so awareness has to be designed as a behaviour control inside a broader governance model. The practitioner conclusion is that training value should be judged by reduced exposure, not by completion rates.
A question worth separating out:
Q: Should organisations prioritise awareness or security tooling against ransomware?
A: They should do both, but not as substitutes. Tooling can block or detect many attacks, while awareness reduces the chance that a user creates the initial foothold. The right question is where each control reduces risk most effectively, then how they work together to stop extortion before it becomes a full incident.
👉 Read our full editorial: Security awareness as a control layer against ransomware and extortion
This post was modified 2 days ago by NHI Mgmt Group