Security culture
Security culture is the shared expectations, attitudes, and everyday practices that shape how people handle security within an organization.
Watch what happens when security slows something down
A policy may tell staff to verify an unusual request. Culture affects whether they feel able to do that when a senior person is impatient, a deadline is close, or they have already made a mistake.
NCSC describes security culture as shaped by leadership, goals, processes, and organizational structure. Its guidance warns that leaders asking for special treatment signal that bypassing procedures is acceptable. An annual lesson cannot resolve that contradiction by itself.
Training still has a role. NIST SP 800-50 Revision 1 connects learning with behavior and ongoing program improvement. The lesson needs support from the way work actually gets done.
Make it possible to speak up
People need a clear reporting route and a useful response when they use it. NCSC recommends treating incidents as opportunities to learn, while keeping accountability. That means understanding what happened and fixing the conditions around it, rather than making reporting feel like an admission to avoid.
Ask staff where procedures are difficult to follow and what happens after they raise a concern. The help-desk verification article illustrates a place where permission to pause a request matters.
A click rate cannot describe all of this. More reports might reflect greater confidence in reporting, more suspicious activity, or both. Look at the reports and the surrounding conditions before interpreting the count.
Security Awareness Needs Evidence Beyond Completion explains why participation records need to sit alongside observations of real work.