Cybersecurity Awareness Month has been observed for over two decades. The campaign has generated hundreds of millions of dollars in training content, awareness materials, and security gadgets. Employees have been exhorted to use strong passwords, avoid phishing, and think before they click. Compliance departments have checked boxes on awareness training requirements. Yet, despite all this effort, the statistics on breaches and security incidents have not improved meaningfully. Data breaches remain common. Phishing attacks remain effective. Employee actions remain a significant factor in breach causation. This raises a difficult question: Is Cybersecurity Awareness Month actually moving the needle, or is it security theater?
The Case Against Traditional Awareness Campaigns
Traditional awareness campaigns operate under the assumption that knowledge drives behavior change. If employees know how to identify phishing, they will avoid phishing. If employees know that password reuse is risky, they will use unique passwords. The evidence suggests this is not how behavior change works.
Awareness training is often generic, divorced from employees’ actual work and the actual threats they face. A retail employee learns about security hygiene from the same training as a healthcare employee, even though they face different threats and have different risk profiles. Employees click through the training to get compliance credit, not because it changes their behavior. Months after training, the lessons fade from memory and behavior reverts to convenient shortcuts rather than security practices.
If Cybersecurity Awareness Month were moving the needle, we would see declining breach statistics, declining phishing click rates, and declining security incidents caused by employee action. We see the opposite. This suggests that awareness campaigns, as traditionally conducted, do not work.
What the Research Says
Behavioral science research on security awareness reveals several findings that conflict with traditional awareness campaign assumptions:
- Knowledge about security is not strongly correlated with secure behavior. Employees who score well on security awareness tests still make insecure choices when under time pressure or cognitive load.
- One-time training has minimal impact on behavior. The effect of awareness training degrades rapidly after completion.
- Punishment for security violations (consequences) drives behavior change more effectively than education about risks.
- Social norms (what others do) influence security behavior more than knowledge of best practices.
- Habit and convenience override security knowledge. Employees use weak passwords not because they do not know better, but because strong passwords are inconvenient.
The Three Things That Actually Move the Needle
Rather than continuing with awareness campaigns of questionable effectiveness, focus on three approaches that have demonstrated evidence of actually reducing risk.
One: Executive Engagement in Security Governance
The single most powerful signal an organization can send about security is that executive leadership takes it seriously. When the Chief Executive Officer, board members, and senior executives visibly engage in security governance, security becomes an organizational priority. When executives skip security briefings, delegate security to technology staff without oversight, or treat security as a compliance checkbox, security becomes marginalized.
Practical steps to increase executive engagement in security governance:
- Establish a board-level Cybersecurity Committee or assign cybersecurity oversight to the Audit Committee with explicit responsibility and regular reporting.
- Conduct quarterly board briefings on security strategy, threats, incidents, and resource requirements. Make the briefing substantive, not a checkbox.
- Make security a permanent agenda item in executive leadership meetings. This signals that security is an ongoing priority, not an occasional concern.
- Have the Chief Information Security Officer report directly to the Chief Executive Officer or to a board committee, not buried in the organization.
When your employees see that the Chief Executive Officer receives regular security briefings, that the board asks about security, and that security is a topic of executive concern, security becomes a priority throughout the organization. This cultural signal, more than any awareness campaign, drives behavior change.
Two: Incident Response Readiness
The second action that moves the needle is ensuring your organization is prepared for the incidents that will occur. Prevention is the ideal, but perfect prevention is not possible. When incidents occur (and they will), how your organization responds determines the impact. Poor response amplifies damage. Excellent response contains damage.
Incident response readiness has multiple components:
- Incident response plan that is documented, roles and responsibilities are clearly assigned, and decision authorities are defined.
- Regular tabletop exercises and simulations that test your plan and identify gaps. Annual exercises are the minimum. More frequent exercises are better.
- Dedicated incident response team with clear authority to make decisions without seeking approvals. In a crisis, you cannot wait for approval from multiple layers of management.
- Forensic capabilities either built in-house or available through vendors who can preserve evidence and determine breach scope.
- Communication plan that specifies how internal leadership, customers, employees, and regulators will be notified and what information will be shared.
- Legal counsel and insurance coordination. Understand your cyber insurance policy. Have legal counsel on retainer for incident response.
Organizations with mature incident response capabilities recover faster from incidents, contain damage more effectively, and demonstrate competence in crisis management. They are also better positioned to learn from incidents. Each incident is an opportunity to improve your capabilities and prevent similar incidents in the future.
Three: Third-Party Risk Management
Your organization’s security is only as strong as its most vulnerable vendor, contractor, or supply chain partner. In 2026, third-party compromise is a primary attack vector. Nation-state actors and organized cybercriminals target large organizations by compromising their vendors. Ransomware gangs distribute malware through supply chain compromises.
Effective third-party risk management includes:
- Inventory of critical vendors, contractors, and supply chain partners. Identify which vendors have access to sensitive data or critical systems.
- Risk assessment of third parties based on their access and importance to your business. Not all vendors require the same level of scrutiny.
- Contractual requirements specifying security obligations, right to audit, incident notification requirements, and breach liability.
- Ongoing monitoring of third-party security posture through security assessments, questionnaires, vulnerability scanning, or other methods.
- Incident response coordination with critical third parties so that if they are breached, you can identify potential exposure to your organization.
Third-party risk is expanding because of supply chain complexity and the expansion of cloud infrastructure. Organizations that manage this risk systematically reduce their exposure significantly.
What This Means for Awareness Month
If these three things (executive engagement, incident response readiness, third-party risk management) move the needle more than traditional awareness campaigns, should organizations abandon awareness altogether? No. But awareness programs should be designed differently.
Awareness as Culture, Not Compliance
Redesign awareness to build security culture, not to generate compliance reports. Focus on executives and leadership. If executives understand security and prioritize it, security culture follows. Generic employee training is less valuable than ensuring leadership understands the organization’s threat environment and risk profile.
Awareness as Role-Specific, Not Generic
Rather than a single annual training session for all employees, provide role-specific training. Finance staff need to understand fraud and social engineering relevant to finance. Developers need to understand secure coding. Executives need to understand governance and risk. Target each group with content relevant to their role and threat profile.
Awareness as Ongoing, Not Annual
Make security awareness continuous, not an annual checkbox. Monthly security briefings, quarterly phishing simulations, role-specific training tied to new threats or business changes. Frequent reinforcement is more effective than a single annual training session.
Practical Next Steps
As October draws to a close and Cybersecurity Awareness Month ends, what should you do differently next month? Three things:
Action One: Schedule a Board Briefing on Security Strategy
Do not wait until next Cybersecurity Awareness Month to engage board and executive leadership. Schedule a security strategy session with your board or board committee this quarter. Present your organization’s threat environment, your current capabilities, your major risks, and your resource requirements. Ask for direction and engagement.
Action Two: Conduct an Incident Response Readiness Assessment
Review your incident response plan. Is it documented? Are roles and responsibilities assigned? When was it last tested? If you have not conducted a tabletop exercise in more than a year, schedule one immediately. Identify gaps in your response capability and create a plan to address them.
Action Three: Audit Your Third-Party Risk Program
Inventory your critical vendors and contractors. Identify which have access to sensitive data. Assess the security of your most critical vendors. If you do not have contractual requirements in place, add them. If you have not assessed third parties in more than a year, refresh assessments.
Conclusion: Focus on What Works
Cybersecurity Awareness Month serves an important purpose: it reminds organizations that security is important and focuses attention on security practices. However, the three things that actually reduce risk are less sexy and less visible than awareness campaigns. They are harder to quantify and harder to demonstrate to the board with nice graphics. But they work.
The Chief Information Security Officer who focuses on executive engagement, incident response readiness, and third-party risk management will deliver more security value than the one who pours resources into traditional awareness campaigns. This is True CISO thinking: focusing on what works rather than what is easy to measure or looks impressive to auditors.
Valukoda helps growing businesses make smarter technology decisions. Whether you need strategic IT leadership, managed services, or a security program built from the ground up, we bring decades of CIO and CISO experience to your team. Schedule a conversation or call us at 888.380.7212.
© 2026 Valukoda, Inc. All rights reserved.
