AI-enabled phishing, deepfake scams, and sophisticated social engineering mean the topic of cyber resilience must increasingly be owned between teams.
Security teams may understand the risks employees face, and L&D teams understand how people learn, retain information, and alter their behaviour. But strong cyber awareness programmes will need both.
Our checklist below helps align CISOs, security awareness managers, and L&D leaders at around a more effective approach to cyber resilience learning. The quick scoring guide lets you gauge your organisation's preparedness, with discussion points and practical next steps to start you out on the path to improved workforce cyber resilience.
Cyber resilience learning: What good looks like
A resilient workforce cannot be built solely off the back of awareness content. Employees need regular and realistic practice, clear reporting expectations, continuous reinforcement, and learning experiences that help them act when something feels suspicious.
This checklist helps you assess whether your current cyber learning approach is:
Relevant to the modern-day threats your organisation faces
Engaging enough to hold people’s attention
Designed to support behaviour change
Reinforced beyond one-off training
Measurable in ways that matter to security and L&D
Clear about reporting expectations
Credible for senior stakeholders
The shared model of cyber resilience
Security defines the risk
CISOs and security teams should clarify:
Which human-risk behaviours matter most
Which employee groups are most exposed
Which threat scenarios are becoming more common
Which reporting behaviours need to improve
What evidence is needed for leadership, audit, or
compliance conversations
L&D shapes the learning
L&D teams should clarify:
How to make cyber learning engaging and accessible
How employees will practise decision-making, not just absorb information
How learning will be reinforced over time
How content will fit into the flow of work
How learning transfer and behaviour change will be supported
Strong programmes connect cyber risk with learning design. They help employees recognise threats and then respond appropriately and quickly.
