DOI: 10.69554/zket6324 ISSN: 2398-5119

From compliance to behavioural risk mitigation: A strategic framework for security awareness transformation

Cecelia Finney
Show PDF Cite
Traditional security awareness programmes rely on annual training, phishing simulations, and engagement campaigns. These approaches generate activity and compliance metrics, but they do not effectively reduce human-driven security risk. This paper presents a strategic framework for shifting from campaign-based security awareness to behavioural risk mitigation, grounded in a decade of leading security awareness across one of the USA’s largest and most complex higher education systems. The framework addresses what prompted the shift, what analysis revealed about the limitations of traditional approaches, how buy-in was built to pivot toward behavioural risk mitigation, and what security leaders should consider when implementing similar transformations. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.

More from our Archive