Digital safety training courses will also help make security a natural reaction and not something workers have to think about first.

IT leaders should hold regular sessions addressing spotting phishing attempts, password management, handling confidential data and, for remote employees, VPN usage and network segmentation.

This training should include company-specific needs. IT execs can find these by reviewing security incident histories to look for trends. Any frequently targeted vulnerabilities or repeated mistakes deserve attention in employee training.

When Yahoo built a culture of cybersecurity, it found measuring results was essential to successful training. After training employees, you should test them to reinforce practices and see how impactful the session was.

For example, after a social engineering training session, IT could simulate a phishing attack to assess how employees apply what they’ve learned, then hold a post-mortem session to go over what they did right and wrong.

Remember: this isn’t a one-and-done process. Training and assessments should regularly go over the same topics to reinforce key ideas and measures.

Gamification can make these more interesting, make the lessons more likely to stick, and motivate employees. Create a spirit of competition or offer rewards to increase engagement.