Security culture is visible in small decisions
Security awareness programmes often focus on what employees know. Attackers exploit what employees actually do.
An employee may know that password reuse is bad and still reuse one because the approved password manager is inconvenient. They may recognise that unknown USB devices are risky and still connect one because a meeting starts in two minutes. They may understand phishing in theory and still approve an MFA prompt because they are distracted.
That gap between knowledge and behaviour is where security culture becomes measurable.
1. The temporary password that never becomes temporary
Temporary credentials have a habit of becoming permanent.
A project account is created quickly. A shared login is distributed to a team. A vendor receives a password for troubleshooting. Everyone intends to change it later, but the system works and the pressure moves elsewhere.
The risk is not only weak password strength. Temporary credentials are often shared, poorly owned, excluded from normal lifecycle controls and reused across environments. When one leaks, responders may not even know who is still using it.
The better habit is to make temporary access expire automatically and assign every account a clear owner.
2. The unlocked screen during a five-minute break
Physical access is still access.
An unlocked workstation in a meeting room, shared office or client environment can expose email, documents, administrative consoles, browser sessions and internal applications without triggering any technical exploit.
The important habit is not memorising a policy about screen locking. It is building an automatic response: leave the desk, lock the device.
Awareness should create habits that survive busy days, travel, deadlines and distraction.
3. Plugging in the device because it looks harmless
USB drives are the obvious example, but the principle is broader. Unknown peripherals, cables, adapters and devices should not automatically receive trust because they look familiar.
A device may expose storage, emulate a keyboard, present a network interface or interact with the system in ways the user does not expect.
Organisations should give staff a simple alternative: a clear process for transferring files, approved peripherals and an easy way to report or hand over unknown devices.
Security awareness fails when the secure option is harder than the risky option.
4. Oversharing the organisation for attackers
Social media creates an extraordinary amount of free reconnaissance.
Job announcements reveal teams and technologies. Conference photos show badges, office layouts and screens. Project posts reveal vendors and cloud platforms. Public profiles show reporting lines, roles and responsibilities.
None of those details is necessarily sensitive by itself. Combined, they help attackers create more credible phishing, impersonation and pretexting scenarios.
The goal is not to stop employees from using social media. It is to make them recognise when apparently harmless context could help someone imitate a colleague, supplier or internal process.
5. Letting politeness override access control
Tailgating works because people do not like challenging strangers.
A person carrying boxes, wearing a visitor badge or saying they forgot their access card can create a socially uncomfortable moment. Employees may hold the door open rather than risk appearing rude.
Attackers exploit that hesitation.
Good physical-security culture gives employees permission to follow the process without turning them into security guards. “I can’t badge you in, but reception can help” is enough.
Awareness programmes should measure behaviour, not attendance
Completion rates are easy to report and weak as a security outcome.
More useful measures include phishing-reporting rates, repeat risky behaviour, MFA-prompt reporting, policy exception trends, suspicious-email escalation time and whether staff know the correct reporting channel when something feels wrong.
Training should also change based on observed behaviour. If users are consistently falling for credential-harvesting pages, the answer is not another generic annual module. It is targeted reinforcement, realistic simulations and technical controls that reduce the consequence of one mistake.
Security culture improves when people understand the decision they are being asked to make and the organisation makes the secure choice easy to perform.
