A challenging new approach
"Most awareness programs in the past have failed to change behavior," said Spitzner. "However, that is because most programs in the past were not designed to change behavior. Their only goal was to meet compliance requirements, to check the box. As a result, the absolute minimum was invested."
"These bare-minimum awareness programs are the ones where someone runs a single PowerPoint presentation once a year, or perhaps sends out a quarterly security awareness newsletter," Spitzner continued.
For an awareness program to effectively change behavior, Spitzner said organizations need to create programs that are designed from the ground up to change behavior.