How an engineering company trusted for advanced medical and surgical solutions assessed, trained and measured its people from January to May 2023.
An engineering company with a trusted reputation needed its people to be as strong as its engineering.
The company needed to be sure its staff were well-versed in data protection.
With phishing attacks growing in frequency and sophistication, employees needed to be assessed and trained to spot them.
People are involved in most breaches, so training employees on cybersecurity best practice is vital.
The company set out to find its biggest human risk areas, then strengthen them with regular training, phishing simulations and dark web monitoring.
A questionnaire sent to each employee to find their security knowledge gaps and where they most need training.
A personal program sending one course per week, with a minimum pass score of 85%.
Ongoing dark web monitoring to help catch early-stage attacks that use stolen employee credentials.
Periodic simulations to track which employees are vulnerable and to measure the impact of training.
January to May 2023, after almost six months.
Overall human risk fell by 439 points. The biggest gain came from phishing risk, which fell by 303 points as fewer employees were compromised in simulations.
| Area | January 2023 | May 2023 | Change |
|---|---|---|---|
| Company risk score | 575 | 136 | −439 |
| Breach risk | 30 | 25 | −5 |
| Learning risk | 200 | 129 | −71 |
| Phishing risk | 350 | 47 | −303 |
Risk scores combine training, phishing and dark web breach results into one human risk score, where lower is better. The company score runs from 0 to 900, with 900 the worst possible, and ended at 136, a “Good” score. Phishing risk is scored out of 550, and the biggest improvement came there.
Get a free human risk report: your exposed credentials, how your team handles a simulated phishing email, and a plain-language plan to fix what we find.
Get my free report