67% of organizations say employees lack basic security awareness

Image via Unsplash

Fortinet’s 2024 Security Awareness and Training Global Research Report reveals 67% of organizations are concerned that employees lack fundamental security awareness. This percentage has increased since 2023, when 56% expressed concerns with employee security awareness. Perhaps as a result, 94% of organizations want to implement more stringent cybersecurity policies for high-risk employees.

Key findings from the report include:

62% of leaders anticipate their employees will fall victim to threat methods utilizing AI.
31% of organizations do not monitor or manage the use of AI applications among employees.
89% see improvements to organizational security posture after security awareness training is implemented.

Amit Zimerman, Co-Founder and Chief Product Officer at Oasis Security, offers the following advice for organizations seeking to improve employee security awareness training.

“Regular employee training remains essential in combating today’s threats, however, training must evolve beyond static lessons. Incorporating phishing simulators to mimic real-world attacks enables employees to apply their training in dynamic environments, testing their ability to recognize and respond to threats effectively. However, education alone isn’t sufficient,” Zimerman asserts. “IT security teams must implement strong identity and access management (IAM) frameworks with compensating controls like multi-factor authentication (MFA) to mitigate phishing attempts.

“Attackers are increasingly looking at weaker parts of the perimeter, such as non-human identities (NHIs), which control machine-to-machine access and are increasingly critical in cloud environments. NHIs now outnumber human identities in most organizations, and securing these non-human accounts is vital, especially in AI-heavy architectures like Retrieval-Augmented Generation (RAG) systems.

“To successfully integrate AI-enabled security tools and automation, organizations should start by evaluating the effectiveness of these tools in their specific contexts. Teams should test tools against real-world data to ensure they provide actionable insights and surface previously unseen threats. Existing security frameworks may need to be updated, as older frameworks were designed for non-AI environments. A flexible approach that allows for the continuous evolution of security policies is critical.”

Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!

Jordyn Alger is the managing editor for Security magazine. Alger writes for topics such as physical security and cyber security and publishes online news stories about leaders in the security industry. She is also responsible for multimedia content and social media posts. Alger graduated in 2021 with a BA in English – Specialization in Writing from the University of Michigan. Image courtesy of Alger

ON DEMAND: In this webinar, Regina Lester, Vice President of Security & Safety Operations at Toledo Zoo, will share her insights on implementing security technologies in the entertainment sector and the challenges all organizations face — large and small — when it comes to balancing budget and security.