The Impact of Security Awareness Training - Employee Practices and Perceptions in Phishing Prevention

Sammanfattning

As the threat of cyberattacks grows, so has the need for organizations to defend themselves. Employees are often considered to be the last line of defense where mandatory training has become standard practice. However, the effectiveness of such training remains contested. While recent studies suggest that it is not a knowledge problem but rather an attention problem, this perspective does not fully capture the complex interplay of several factors such as motivation, stress and confidence. This guides attention to how employees perceive and experience security awareness training in their everyday practices. The thesis investigates the following research question: “How do employees perceive security awareness training, and what consequences do they experience in their everyday work practices?” This study implemented a phenomenology strategy with nine semi-structured interviews, in order to gather data on employees’ perceived thought, effects or consequences from implemented anti-phishing training. Thematic analysis was used to decode and derive themes related to our research question from our collected data. The findings show that security awareness training is often perceived as repetitive and of limited personal value, particularly among experienced staff, but is still considered important to maintain cybersecurity awareness. In general, it functions mainly as a recurring reminder that strengthens vigilance and security-related behaviors, although it may also lead to stress and frustration in some work situations. The results indicate that employees perceive security awareness training as valuable and relevant, however, the primary effectiveness associated with the training was not the content itself. Further research could explore how different professional roles affect the perceptions of security training. Furthermore, this study could help design future awareness training programs that are more engaging to employees.