Topic starter
02/08/2026 12:08 pm
TL;DR: Ransomware and cyber extortion campaigns still exploit people first, not just technology, and Knowbe4’s whitepaper argues that security awareness must sit inside a defence-in-depth model rather than act as a standalone control. That matters because phishing, social engineering, and audience-specific messaging remain governance problems as much as training problems.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper: Building a Security Awareness Program to Help Defend Against Cyber Extortion and Ransomware”.
Key questions
Q: What breaks when security awareness is treated as a standalone ransomware control?
A: It breaks at the human decision point.
Q: Why do phishing and credential stuffing still matter in ransomware cases?
A: They remain effective because ransomware affiliates exploit identity weaknesses at scale.
Q: What are the signs that an awareness programme is failing?
A: The clearest signs are repeated user interaction with suspicious messages, weak reporting rates, low follow-through on simulations, and recurring incidents that begin with the same social engineering pattern.
Practitioner guidance
- Map awareness content to attack paths Build role-based modules for finance, executives, service desk, and general staff so the examples match the requests each group actually receives.
- Tie simulations to reporting behaviour Measure whether users report suspicious messages quickly and consistently, rather than only tracking click rates or completion percentages.
- Connect awareness to identity controls When users fail simulations or report suspicious activity, link the event to authentication hardening, session review, and account monitoring.
Bottom line: Ransomware and extortion campaigns still depend on human trust, so awareness is best treated as a control layer that supports defence in depth.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:12 pm
Security awareness is a compensating control for human trust, not a standalone defence. The article is right to reject the idea that technology alone can stop ransomware and extortion. These campaigns still rely on people making one bad trust decision, so awareness has to be designed as a behaviour control inside a broader governance model. The practitioner conclusion is that training value should be judged by reduced exposure, not by completion rates.
A question worth separating out:
Q: Should organisations prioritise awareness or security tooling against ransomware?
A: They should do both, but not as substitutes. Tooling can block or detect many attacks, while awareness reduces the chance that a user creates the initial foothold. The right question is where each control reduces risk most effectively, then how they work together to stop extortion before it becomes a full incident.
👉 Read our full editorial: Security awareness as a control layer against ransomware and extortion