Most organisations have a cybersecurity compliance programme. Far fewer have a cybersecurity culture. These are not the same thing, and the difference has significant consequences.
A compliance programme produces documentation that requirements were met. It demonstrates that employees completed the annual training module, that policies are in place, that the organisation can show an auditor a coherent set of controls. This has value. It does not, by itself, change behaviour.
A genuine cybersecurity culture is the set of values, norms, and habits that determine how people actually behave when no one is checking, when the policy is inconvenient, when verification would slow something down, when the right thing and the easy thing are in tension.
Why Most Security Culture Initiatives Fail
The most common failure mode in organisational security culture work is treating it as a training problem. Leadership identifies that human behaviour is a significant risk factor and commissions a training programme to address it. The programme is delivered. The boxes are checked. The behaviour does not meaningfully change.
This happens because training changes knowledge, not habits. In cybersecurity, the gap between what people know and what people do is significant. Most employees who click phishing links in simulation exercises know, in the abstract, that phishing exists. The knowledge was present. The habit of pausing, verifying, and questioning was not sufficiently embedded to override the automatic response.
Habits are built through repetition in context, not through information delivery. The context of a thirty-minute annual training module is so far removed from the actual work environment where the habits need to operate that the transfer is minimal.
The Six Foundations of a Real Security Culture
1. Leadership that models the behaviour
Security culture is built from the top down, whether or not leadership intends it. When senior leaders use personal devices for sensitive work, share credentials with assistants, or treat two-factor authentication as an obstacle rather than a requirement, they communicate that security is negotiable for the people who matter.
Conversely, leaders who visibly comply with the same processes they require of everyone else build a different signal. That signal is what determines whether the organisation's security behaviours are performative or genuine.
2. Psychological safety around incidents
The most reliable predictor of reporting speed is whether the culture makes reporting safe. Organisations that respond to security incidents with blame build cultures in which people hide mistakes. An employee who suspects they have been phished and fears disciplinary consequences will often not report it. The breach proceeds undetected.
Organisations that treat incident reporting as a valuable contribution build cultures in which incidents surface quickly. The same breach, reported within minutes rather than days, has a dramatically different outcome.
3. Friction in the right places
Security behaviour changes when the safe action is easier than the unsafe one. Most security failures happen not because people choose to be unsafe but because the unsafe action is the path of least resistance. Well-designed security processes create friction at the critical decision points, verification requirements, dual approvals, second-factor authentication, that make the dangerous path meaningfully harder to take.
4. Realistic simulation over compliance theatre
The most effective security awareness programmes use simulation to build genuine pattern recognition. The difference is in design and debrief. A compliance simulation uses an obvious fake and reports a low click rate as evidence of a secure workforce. A genuine simulation uses the level of sophistication that real attackers actually use and treats a high click rate as useful diagnostic information rather than a failing grade.
5. Security embedded in processes, not layered on top
The most durable security behaviours are built into how work happens rather than added as additional steps. A dual-control requirement for financial transactions is not a security add-on. It is how financial transactions work in that organisation. This distinction matters because it changes the experience of the behaviour. A security step that feels like an interruption is resisted. A security step that is normal work is simply done.
6. Measurement of behaviour, not just completion
Most security programmes measure inputs rather than outcomes, training completion rates, phishing click rates, policy acknowledgment. These metrics tell you whether people were exposed to the programme. They do not tell you whether the programme changed anything.
Organisations serious about security culture invest in measuring actual behaviour: mean time from incident detection to report, frequency of unusual request verification, number of incidents reported proactively versus discovered retrospectively.
The Long Game
Building a genuine cybersecurity culture takes longer than deploying a security training programme. It requires sustained investment from leadership, ongoing measurement and adjustment, and the patience to treat behaviour change as a multi-year initiative.
The organisations that make this investment consistently outperform those that do not, not just in security metrics, but in the broader organisational qualities that security culture requires and develops: psychological safety, honest communication, clear accountability, and leadership that means what it says.
