How to Make Cybersecurity Training More Engaging

TL;DR

Cybersecurity training becomes more effective when it uses entertainment, storytelling, emotion, and memorable examples instead of relying only on facts and compliance requirements. Programs should meet people where they are, observe audience reactions, and provide practical actions that help individuals protect themselves, their families, and their coworkers.

Transcript

Hello everyone, and thanks for joining us l- in this live stream with RSA Conference. Today, I am joined by two speakers whose session was one of our top-rated sessions at RSA Conference 2023, Jenny Brinkley and Lisa Plaggemier. I'm just gonna take a moment for... to have each of them introduce themselves before we dive into our discuss- discussion... Read More

Key Insights

• Boringness is a central weakness of many security training programs, regardless of whether the instruction is mandatory, delivered frequently, or presented at the moment of need. People generally resist dull material, so training must earn attention through inherently interesting and engaging communication.
• Entertainment can support cybersecurity education by attracting attention without sacrificing useful instruction. High energy, humor, and interesting examples can help audiences understand security messages, remember practical takeaways, and identify changes they can apply within their own programs or recommend to other teams.
• Examples from other industries can reveal effective approaches to security communication. Airline safety videos and Australian public service announcements demonstrate how familiar educational messages can be delivered creatively, encouraging people to pay attention while still leaving them with information intended to improve their behavior.
• Emotional engagement is part of effective security awareness because people do not make decisions through rational analysis alone. Storytelling, humor, surprise, and other emotional elements can strengthen a factual message by addressing the whole person rather than appealing only to intellect or compliance obligations.
• Audience reactions provide immediate evidence about whether communication is working. Presenters can watch whether people lean in, lean out, laugh, sigh, or otherwise respond at intended moments, then use those signals as a model for evaluating security training and awareness materials.
• Community and personal relevance can make security education more meaningful. Training can connect safer online behavior with being a better family member, partner, or coworker, helping participants see cybersecurity as a shared responsibility that protects both themselves and the people around them.
• A strong conference proposal distinguishes itself from the large volume of information competing for attention. Reviewers and audiences may tire of familiar topics, so submissions should emphasize an uncommon perspective, a unique lesson, or a difficult career experience that produced meaningful growth.
• A session description serves two audiences: the committee deciding whether to accept the proposal and the attendees deciding whether to watch the presentation. It should clearly communicate what is distinctive about the topic while setting expectations for valuable, actionable, educational, and non-promotional content.

Questions & Answers

Q: How can cybersecurity training become more engaging?

Cybersecurity training can become more engaging by combining useful instruction with entertainment, energy, storytelling, humor, and practical takeaways. The material should meet people where they are and address both emotion and intellect. Examples from airline safety videos or public service announcements can also demonstrate creative ways to capture attention while preserving a serious educational message.

Q: Why is boring security awareness training ineffective?

Boring security awareness training struggles because people do not enjoy dull material, even when participation is mandatory or the information is important. Compliance requirements and factual content alone do not guarantee attention. Training should be innately interesting enough to compete with other content, evoke appropriate reactions, and leave participants with actions they can apply in everyday life.

Q: How does entertainment help security behaviors stick?

Entertainment helps security behaviors stick by gaining attention and connecting information with emotion. Humor, surprising examples, and energetic delivery can make serious messages more memorable without removing their educational purpose. When participants enjoy the experience and understand the practical lesson, they are more likely to recognize how the guidance applies to themselves, coworkers, families, and security programs.

Q: Why should security training use storytelling and emotion?

Security training should use storytelling and emotion because people are not completely rational in every decision. Facts, policies, and compliance requirements address only part of the person receiving the message. Stories and emotional cues can create connections, evoke intended responses, and communicate lessons in ways that audiences can understand, remember, and relate to their own behavior.

Q: How can trainers tell whether an audience is engaged?

Trainers can assess engagement by watching how the audience responds throughout a presentation. People may lean in, lean out, laugh, sigh, or display other reactions at particular moments. Comparing those responses with the emotions the trainer intended to evoke can reveal whether the material is connecting and whether its timing, examples, and delivery are effective.

Q: What outside examples can improve cybersecurity education?

Cybersecurity educators can study communication from industries and campaigns outside security. The speakers highlighted changing airline safety videos and Australian public service announcements as examples of material designed to attract attention while teaching important behaviors. These references show how humor, creativity, and unexpected presentation choices can make familiar safety guidance more noticeable, understandable, and memorable.

Q: How can a cybersecurity conference proposal stand out?

A cybersecurity conference proposal can stand out by offering something outside the ordinary, such as a fresh perspective, a distinctive lesson, or a difficult career experience that led to growth. Because reviewers face many topics competing for attention, the submission should clearly separate itself from familiar material and explain why its content will matter to attendees.

Q: Who should a conference session description address?

A conference session description should address both the committee reviewing the submission and the audience that may eventually attend the presentation. It must help reviewers recognize what is different and valuable about the proposal, while also showing prospective attendees that the session will provide engaging, actionable, educational, and non-promotional content worthy of their limited attention.

Summary & Key Takeaways

• Lisa Plaggemier and Jenny Brinkley describe an epidemic of boringness in security training. They argue that mandatory status, delivery frequency, and compliance requirements do not justify dull material. Effective programs should combine education with entertainment, energy, practical takeaways, and messages that people can apply to their own online behavior and security programs.

• Their RSAC session used examples from outside cybersecurity, including Australian public service announcements and airline safety videos, to show how entertainment can capture attention while conveying serious information. Humor and unexpected material generated laughter during the early morning presentation, creating positive energy and helping attendees connect education with memorable emotional experiences.

• The speakers also offer guidance for conference submissions. A proposal should stand apart from the constant competition for attention by presenting an unusual perspective, distinctive lessons, or meaningful career stories. Its description must appeal both to the committee evaluating submissions and to the eventual audience deciding whether the presentation deserves their time.