Are employees the biggest security risk, Mr Schick?
I wouldn’t put it that way. In fact, well-trained and security-aware employees are a key pillar of effective cyber resilience. That said, cybercriminals tend to target the weakest link in the chain—and that’s often the individual user. This creates a dilemma for modern cybersecurity because when technical safeguards are so effective that only a handful of malicious messages get through, employees may lack the routine needed to spot them. And that’s precisely when attacks succeed—because the psychological triggers in the digital world are the same as in real life—curiosity, pressure, fear, and narcissism.
How do we support employees?
By providing regular training and raising awareness of the risks posed by cyberattacks. Artificial intelligence, for instance, is opening up entirely new dimensions that many people aren’t even aware of—such as CEO fraud involving deepfake videos or spoofed phone calls. It’s essential that training is tailored to each employee’s level of knowledge, because not everyone starts from the same point. But even more important is letting go of the idea that IT security is solely the responsibility of the tech team. Cybersecurity is a collective responsibility that must be embedded across the entire organisation.
Let’s talk about awareness training. What should companies focus on?
From my perspective, there are three key points. First, continuity is crucial. Building awareness isn’t a one-off project—it’s an ongoing process. Second, tailoring the training to specific target groups makes a real difference. An administrator faces different risks than someone working on the production line, so the content needs to reflect that. And third, relevance and practical application are essential. Training should be grounded in real-world threats and closely tied to employees’ day-to-day work.
