Transcript
senior product manager here at SoSafe. So what does that mean? It's my job basically to work very closely with customers to make sure that we're solving European points. My specific focus is on the simulation studio. So my responsibility will extend into making sure that we're giving you the ability to test the awareness levels of your employees. Yes, hello, and welcome from my side as well. Really nice to see you all here. I'm Gundula Zervas. I usually go by Gundi here at SoSafe, and I'm a digital learning expert. So that means I work as an expert for learning science and behavioral science and make sure that we incorporate all these insights into our product. Perfect. So what I'm going to do is I'm going to set the scene a little bit. I'm very conscious it's been a big day. There's been lots of information thrown at you. So this will hopefully be a little bit of fun, but I think it's important for us to step back and have a quick look at the threat landscape. And it's an extension of what you've probably heard today from different talks. First and foremost, speaking with all of you, we've recently published our latest risk report. The 80% of security professionals, so people in this room, believe this is the most complex time we've had in the last five years. One really crazy stat that jumped out to me still was one in two of us in our organizations in the last three years have been successfully hit by an attack. So that's half this room, which still blows my mind every time I see it. So what are the main accelerators to this? Because it doesn't seem to be slowing down. There's a couple of things at play. One, the new technology advancements. I, from a personal perspective, I'm a very passionate advocate for the good of AI. And I think it can bring us lots of really good, positive changes in behavior. But that technology in the hands, the same technology in the hands of bad actors, can also do bad things. So we can very clearly see, in particular at enterprise level, the concerns and challenges that you all have with generative AI. Secondly is global instability. I've actually turned off the news because every time I turn on the news, I get more anxious. But there is geopolitical situations happening right now, which is making our lives more difficult. And that's just the nature of the world we live in today. And lastly, the interconnectivity just of the space and our security supply chains. The more everything becomes interconnected, there is challenges that are being surfaced of what happens if one system falls over? Is this like a crater type effect that will knock on? And the truth of the matter still, once we boil it down, it's the hard truth is cybercriminals focus on one primary target. That's all of us. That's us as people. They prey on our vulnerabilities and our lack of awareness at times and our busy lives that we have. We might just make some mistakes. Cyber attackers know that it just takes one well-crafted phishing mail and they have access to our systems. So again, it keeps coming back to this human element that you've heard over and over again today. Again, one of the stats that hopefully pops up that we have from our risk report is 68% of breaches involve us. They involve a human just making one mistake. And Forrester have actually said this is projected to go to 90% over the coming years. And John here put this perfectly. He's went one step further, where he said every attack comes down to people in some way, in some shape or format. And that brings us to the heart of what we're here to talk about today. And with that, I'll hand over to Gundy. Yes, thank you. Yeah, so we've seen some really, really impressive data here by Tommy showing us why it is so important to place humans at the center when it comes to reducing the risk of falling victim to a cyber attack. And the good news here is that this message has widely arrived in the industry in the past year. So most organizations today agree that it's necessary to have some sort of security awareness training delivered to their employees in order to decrease human risk and avoid becoming victim to an attack. However, so far with the good news, the bad news is that humans and then also human risk are still pretty simplified. So what I mean with that is we see, okay, humans sometimes make mistakes. They sometimes behave in risky ways. So what we do is we take all these behaviors we want to see in our employees, put them in a training, it can be an interactive lesson or a video, and we deliver that to all of them. Basically like a one-size-fits-all solution. And what we see in practice then is that this doesn't really work. Why won't that really work? Well, that's because humans are a little bit more complex than that. And let's now find or use a couple of minutes to dive into these complexities and look at why they are so important when it comes to security awareness and training. So what we know about people in general is they are pretty different, right? They are very varied, very varied, very diverse. So what a typical workforce might look like is like this. So we first of all may have just different risk levels that humans are subjected to at the very, very start without even having any influence on that. Think of maybe, for example, a person who has just recently joined your organization who doesn't really know the ins and outs yet. Such a person will most likely be more vulnerable to any attack compared to a person working with you for years and years and years. They just know how to, yeah, how to recognize certain threats already. Think of the department a person might work in. For example, a person working in, say, HR might not necessarily be subjected to higher risk, but also just different risk compared to a person working in, say, the financial departments. They might just be vulnerable to different strategies of social engineering, which is also something we have to account for. Think about work context. A person who primarily works from home, who has to, for example, log in via their personal network, who doesn't see their colleagues face-to-face over a long period of time, they will have also a higher risk of becoming a victim to attack compared to a person who uses the office every day. And, of course, we also have to think about the individual skill level that a person brings with them at the start of the training. So some people come with a pretty solid basic knowledge about cybersecurity, and these people might have a much faster pace of learning and might also not need such detailed instruction compared to a person who just doesn't have this basic knowledge yet. So what can we actually gain from acknowledging these differences between our employees? Well, first of all, we know from motivational research that people who receive training that actually fits to their personal skill level, meaning training that's neither too easy nor too difficult, these people can profit much more from this training. They will be much more motivated to engage with the content and, in turn, this will boost the learning effect. They will be able to remember much more and put this knowledge into practice. Also think about the actual behavioral change we can induce with the learning content we give to people. So when people perceive that the training we give them is actually relevant to them personally and the everyday work they have to do, it's more likely that they will see a benefit from using this knowledge and actually implementing it into their daily behavior. And obviously there's also a time component, a component of time efficiency, because if we can avoid giving people unnecessary training, so for example think back of the home office example, we don't have to teach people who only are in the office how to work from home. If we can avoid giving them these unnecessary content, we not only save them some time and free up some capacity, but we also avoid some sort of learning fatigue. We don't exhaust them so much with learning so their minds are much fresher for the stuff that's actually relevant for them. So all in all, what we see is that people are very, very different, very varied, and it is incredibly important to acknowledge these differences in order to deliver security awareness training that can actually have an effect in this production. And we'll hand over to Tommy again, who will tell us a little bit about how we approach this issue at Solsafe. Thank you. So just building on what Gundy said there, from a technology perspective, what does this all mean for us and the products that we've built? So we probably had to look ourselves in the mirror a little bit, and once we looked at this, what Gundy was talking about there, this one-size-fits-all, I think in particular the experience that we were providing was really good to raise general awareness, but if we were honest with ourselves, we were not treating every individual as an individual. And when we broke this down into first principles, and again building on what Gundy said, a company's risk, all that is is a sum or total of every individual in that organization. So this is the step change that we are now making within our product portfolio. So what I wanted to do is, I wanted to get very practical and give you a very tangible example of what this might look like in Solsafe and using Solsafe products. What I want to get across here is, this is our recommendations, okay? I'm very conscious that different customers have different requirements, and that's totally fine, but there are some common themes and common threads that we would recommend to all of you that we'll talk through. So this is Alex. You've probably seen Alex all over throughout today. Alex, in this scenario, is a sales leader, and we're now, as I touched on, we want our learning experience to be more personal than ever before. So Alex oversees the European sales team. She also travels. So what does that mean for Alex from a learning perspective? So the first time Alex logs into the learning path, we will start to build context of who Alex is and what her job role is. We do this via awareness assessments, which Gigi covered earlier, as well as context surveys. So we really want to know who you are, what your job role is, and what is important to you. So in this example, as we touched on, so Alex travels, she oversees different European offices, so she has said, yes, I have a work mobile phone. So with that context, her learning path then gets updated to reflect her specific job role and needs. This is super important for a couple of reasons. One, because it makes the learning more contextual to her. She's not talking about firewalls. She's not doing training on different things that she will not experience in her real day job. So she's immediately starting off on a good foot because she's learning from real life scenarios that she's likely to experience. And the second thing on this is she doesn't have to spend time doing a bunch of modules on things that she will just not experience. She just will not experience in her day job. And we know from the feedback we've got from you and from end users that they do not want to sit through and do a bunch of modules that just are not relevant. So that's the first thing, super contextual to her job role. But we don't just stop there with e-learning. So the next phase of that personalized journey, which we recommend using, is the simulation studio. So again, Alex will have a tailored simulation experience that's relevant for her job role, her work context, but also her own individual awareness levels. And how we do that is you use behavior-based phishing simulations. And essentially what they are is you will receive simulations at the level of your threat awareness. So a really, really sort of direct example I like to give, if you're really crap at spotting phishing emails, there's no point in you receiving really, really difficult ones because you're too far away from your actual knowledge. So if Alex has a very high click rate, what we'll do is send her easy phishing emails to start to build her confidence and start to build her knowledge of threats. And over time, as that knowledge increases, we will start to test her with a little bit more difficult phishing emails. So we're constantly giving her learning at her level. And this is something that you, as a customer, would just set up once and it would run forever. And it will adapt to every single individual user. So gone are sort of the days where we're bucketing all of IT are really good at spotting emails, or all of finance are really bad at spotting phishing emails. This is contextually relevant to every individual. And also in this example, Alex, because she said she travels and has a mobile phone, we can also send smishing simulations to her because, again, it mimics her real life and how she will be attacked in real life scenarios. And the last thing I'm going to cover in regards to just our recommendations is, you've seen Gigi mention about our launching of Sophie AI. So a big thing that we've tried to do is have more empathy for our end users. And what that means in Alex's scenario, because she's in a sealed role, she spends most of her days in email. That's where most of her conversations with prospects happen, in email, either on desktop and mobile. So in this scenario, Alex has received what she believes could be a potential phishing mail. In today's world, she might have to go and speak to security professionals. She might report that via our PRB button and may not get any feedback. Right now, she will get instant feedback from Sophie AI to say, we believe this is a phishing mail because of x, y, and z reason. This is super important for two reasons as well. It starts to provide really contextual, real-time learning moments because Alex is actively experiencing what she believes is this threat right now. So Sophie will be able to tell her, this is why this is a specific threat, or if it's not, why it's not. And the second really important part that we've talked to security teams about is, they have to manually review all of these emails that get sent to them. So irrespective if you have one person doing this or a team doing this, it all goes into this manual process where you have to actually go through each and every single one, and most of which are not real threats. And it takes a lot of time away from your security team. So Sophie will act as that first level of support, that initial triage, and then she will provide that feedback to the end user to say, no, this is not a threat, or yes, this is. Please go. We recommend that you report that. So that's just three examples or recommendations that we would give to how to get the best out of soCF products to make sure that it reduces risk for you and your organization. And I'll hand back to Gundy, who's going to cover measuring success of personalized learning experiences. Yes, exactly. So I think this all sounds really, really great, right? But with all the things I've been talking about at the start, with how people are so different and so varied and have all these different contexts and skill levels, how can you be in the end sure then that whatever you've done to train them to reduce your risk actually did the trick, actually resulted in some risk reduction? Well, we already gave it away. You have to in some way, shape, or form measure your success of your awareness campaign. And the traditional way this is often done is by looking at training completion, right? So we give our users, for example, e-learning lessons, and we measure how many of our users actually completed the training and call it a success when a certain percentage is reached. And don't get me wrong now, please keep on doing that. It's a good idea because completing a training is a really good indicator that people have engaged with the content, that they have consumed it, and that they actually in turn learned and will implement that behavior. But you shouldn't stop at that point because what we always recommend to people is to, wherever possible, look at metrics that reflect the real world risk behavior as closely as possible. And one really good way of doing that is by looking into our phishing simulation and looking at, for example, the click rate. So how often a user actually clicks on, for example, a link or an attachment in a simulated phishing mail. So if we think back to our example of Alex, she might at the start have quite a high click rate, fall for phishing mails quite often, but this will reduce over time if the training is successful. And if we see that across all our employees, across the entire organization, we have a really, really good indicator that our training resulted in risk reduction. However, you can take this now even a step further because what we always recommend is to not have phishing simulation training as like a one-off thing, right? We recommend to train employees continuously because you can think of recognizing phishing emails as some sort of muscle people have to develop. And as long as I work on that muscle, it keeps developing, but once I stop, well, we know how it works, then the muscle mass decreases and people will then again fall for phishing mails and be more vulnerable. So you should always train your people continuously. And what you can then do is use these metrics I've been talking about, click rate, for example, and drill down to the individual vulnerabilities of your employees. So for example, as I'm showing in this picture here, you could break down your click rate by department and identify the departments that are particularly vulnerable, that have a very high click rate, and then maybe decide to have a more intense training for them or maybe also give them just easier templates because they are not as far in their journey and might need some easier training to get into it, get the hang of it. And that way you can actually make the most of your training. And if you really want to take this even one step further, you can look at the next masterclass we will have, which will be about interventions and looking at how you can look at very specific behaviors and formulate interventions in response to them. So I can really, really recommend that. However, if you do all of this, if you look at the individual differences of your learners, if you account for them, if you implement this personalized learning, you are actually able to craft a more holistic learning experience for your learners. And you will be actually able to reduce the actual risk that your employees will fall for a cyber attack and increase the security in your organization. Thank you. So last slide. Again, just to reiterate, I know there's been like, if you're like me, my brain is nearly full, cognitive overload today with lots of new information. So there's just a couple of things that we wanted to recap on is that transition from one size fits all to personalized learning experiences is super important. And it's definitely something that we would recommend that we start to move to. Again, I'm very conscious, though, that different organizations in this room are at different phases of their development. But there's two things that we will hopefully be able to help you with. So one is just simplifying the complexity to make it a little bit more simple to understand. And secondly, is considering behavior from every angle and every individual's behavior is super important. And the last thing I'll just say before we finish up is, again, your requirements might be slightly different. And you might be looking at this going, I don't know if this really fits for us. I please encourage you to come and chat to us at the product booth. I know, as I said, heads are probably full tonight. Tomorrow, we're going to be there all day. I'm happy to sit down with you and have a conversation to see how we can bring some of these recommendations into your organization, because I am conscious that there are different requirements. So please, please come and visit us at the product booth, and we'll do our best to sit down and have a conversation to see how we can implement some of these things for you. And that's pretty much it from us. So thank you so much for listening. Thank you so much for joining us on stage today. We are doing super well on time, so thank you for that as well, which means that we have time for questions, if anyone has some in the audience. I mean, right now is your chance. There's no busy people line at the product. Microphone is coming this way. Fantastic. Is it working? Yeah. Yeah. Probably more of a question for you, Tom, if you're working closely with clients. I completely agree with the idea of, like, more role-based training and really gearing it on a personal level. But when you're working with your clients, are there other organizations that struggle with the implementation of this? So we could design, like, learning paths for all of our employees, but, for example, senior management might say, yeah, my employees don't have time to do 10 modules a year or 12 modules a year. And then we're sort of restricted to maybe once a year or once a quarter or things like that. Yeah. Really good question. And for what it's worth, this is across the board. We've tried to think about this in, again, breaking it down from that first principles of company risk into individual risk. And what we're trying to promote is if your organization and your employees start to show signals of positive behavior and high levels of threat, we'll start to tailor back the amount of simulations, for example, that you'd have to do. So the general concept is if you're at an easy level, i.e. your awareness is quite low, you should get more simulations and be tested more than someone who's, like, super high-level awareness. And I think that helps with that discussion at a leadership level, because the thing we're conscious of is everyone who's not in a security professional also has a day job. They're super busy. So we need to be empathetic to that. And one way of doing that, in particular, from a simulation perspective, is if you're showing good signals of awareness, we'll start to, and this will be done automatically by the system, you'll start to receive less phishing mails, for example, over time. So again, it's that sort of reward. I think Gina talked about it in the previous masterclass of positive reinforcement and rewarding. So the more awareness you have, the less we will annoy you with phishing simulations, for example. I'll take that from you. Anyone else with questions? I'm just going to stay right here, I think. Here you go. Thank you very much. Gunil, you were talking about behavior and meaningful behavior and indicating where the click rates, of course, measuring. But what other behavior can be measured apart from click rates and phishing? Because this is a question I get asked by my CEO all the time. Can you give me a key P.I. about our maturity? Apart from technical aspects, I'm not really able to answer that. So maybe you might do. So what I would recommend there, and I'm shooting a bit into the blue with that, but I think what you're looking for is some sort of measurement of culture as a whole. So what we have been working on in the past is having a questionnaire, a self-writing questionnaire for employees that will be presented when they first log in into the e-learning. And then we will, of course, over time, repeat the questions over and over again. And this asks things like, okay, how likely is it you think that you might be a target to a cyber attack? To just try and gain some attitudes from them. How important do you think it is to implement these behaviors? To just get these attitudes and try to find a way of getting an idea of how people in the organization as a whole are thinking about cyber security, how important they feel these secure behaviors are. Because knowing how you should behave and actually implementing these behaviors are two completely separate things. And this questionnaire we have been working on, we have already implemented, is our first step to trying to get a measure like this. And then, of course, we would have to ask them this over time, again and again. And if an awareness campaign is actually successful, we would expect that these ratings go higher. That people would say, okay, before I had this training, I was so sure I would never be a victim of attack. But now, since I have clicked on all these phishing ads, I see, okay, even I can fall victim. And this awareness is something really important that makes people much more aware and they pay more attention. I think just in one small addition to that as well, the next masterclass will be really interesting. It will answer that question from a technology perspective. It will be focused on human, my two colleagues up there, and they'll be focusing on the human risk OS. So I won't spoil the party, but what it starts to do is take signals outside of the training. So for example, multi-factor authentication, is that enabled? That's a positive signal towards good awareness levels and good security culture. So we'll start to pull these different external signals, which will all make up this score. I won't say any more because these two are going to kill me if I do, but I'd recommend staying on for that because it will answer that in a little bit more detail from a HR OS perspective. Thank you. No worries. And Tommy just beat me to it because otherwise I would have pointed that way. We have one more question over here and I think we need to call it a day after. Quickly, not actually a question, but a personal experience to your question. We try to do two things. First of all, we have one KPI which gives the ratio between a security event and an actual security incident. So through this, we find out if this ratio improves. So we find out how many events are actually generated by people and how often we actually have a problem. And we see that since we're doing security awareness, actually also since we have introduced SOCIF, the ratio goes down. The second thing that we do is we don't only look at the number of security events or breaches that are being reported, but we also look, and that might be an interesting topic for us with Sophie in the future, how many contacts, so how many consulting requests, for example, we get from business units to the security office in terms of not only things people call the fire brigade when there is a fire, but people are actually asking what can I do to make sure that we don't burn down the building. And we see that the number of questions or the number of consultancy requests is growing, and we see also from the training rates and the phishing click rates, there's a correspondence in this. Thank you very much for that addition, and that's all we have time for today. However, these two are around the rest of the night and tomorrow, so you can find them at the product corner, I'm guessing? Awesome. Thank you again very much for joining. Give them all a hand.
