Phishing is a technique where cybercriminals send fake emails, texts or websites that look like legitimate correspondence to manipulate employees into gaining access to corporate systems or information.
Key characteristics include: &bull; Tries to trigger a quick reaction from you &bull; Provides a link to a separate website &bull; Typically asks you to "update", "validate" or "confirm" private information &bull; Often imitates an official sender (e.g. your company or government or financial institution)

Spot a phish, protect your business

Cyber attacks are a growing concern for organizations across all sectors&mdash;and with good reason. Globally, the average number of security breaches experienced by a company in the last year grew by 11% from 130 to 145, according to 2019 &ldquo;Cost of Cybercrime&rdquo; study by Accenture and the Ponemon Institute.1 As the number of attacks increases, so too does the cost: CyberSecurity Ventures predicts that global losses related to cyber attacks will reach US$6 trillion by 2021, up from US$3 trillion in 2015. 2 A new report from Aon, &ldquo;Prepare for the expected: Safeguarding value in the era of cyber risk,&rdquo;3 notes that business face financial loss in the form of immediate crisis expenses, regulatory fines and lost revenue from disruption to the business. There&rsquo;s also reputational risk, as an attack can erode a company&rsquo;s market value, destroy brand loyalty and limit a company&rsquo;s digital transformation, notes Aon. Businesses are wisely investing in cyber security&mdash;CyberSecurity Ventures predicts more than US$1 trillion will be spent from 2017 to 2021&mdash;but no measures are 100% effective. That&rsquo;s why it&rsquo;s also critical to have a cyber resilience plan in place, which covers how your organization withstands, responds to, and recovers from a cyber attack or data breach. While cyber resilience plans will look different at every organization, one commonality is the importance of testing those plans. A stress test allows organizations to see how quickly and effectively they react and respond to any given cyber risk. As Deloitte notes in the report, &ldquo;Five essential steps to improve cyber security,&rdquo;4 most organizations have a security management process in place, but few have tested it. Globally, the average number of security breaches experienced by a company in the last year grew by 11% from 130 to 145, according to 2019 &ldquo;Cost of Cybercrime&rdquo; study by Accenture and the Ponemon Institute.1
The report outlines key questions organizations should ask, such as &ldquo;Who should be contacted during and after an incident?&rdquo; and how quickly can you contain a security breach and restore your organization to normal operation?&rdquo; &ldquo;But answering the questions is just part of the equation,&rdquo; Deloitte states. &ldquo;Testing your answers is critical.&rdquo; Here are four best practices for testing your cyber resilience plan: 
<ul>
<li>Get everyone on the same page: As with any large undertaking, C-suite support is the first&mdash;and most essential&mdash;step in creating and testing a cyber resilience plan. As one cyber-security expert notes, without C-suite support, it&rsquo;s impossible for cyber-security leaders to effectively plan for and defend against threats.5 And since cyber security affects every employee, everyone in the organization needs to be aware of the plan and understand their roles and responsibilities.</li>
<li>Conduct a vulnerability scan: In the computing world, a vulnerability is a weakness in a device or system that can be exploited by cyber attackers. A vulnerability scan (or assessment) allows businesses to identify which parts of their system are the weakest and most likely to be targeted, and therefore the most relevant to the cyber resilience plan.6</li>
<li>Carry out cyber simulations: As Deloitte notes, cyber simulations are interactive techniques that immerse participants in a simulated attack scenario to help organizations evaluate their response and preparedness. Some specific attacks organizations may want to test for are phishing emails&mdash;fraudulent emails designed to get people to unwittingly share passwords or financial information, or malicious attachments&mdash;documents that appear to be legitimate, but are actually a virus or malware.</li>
<li>Review and make improvements to your plan: &ldquo;There&rsquo;s absolutely no point running simulated attacks if they&rsquo;ll play no role in optimizing the incident response processes,&rdquo; says another cyber-security expert.7 Determine what worked well and what didn&rsquo;t in your response plan. Identify areas for improvement and adjust the necessary processes.</li>
</ul>
&nbsp;
If you&rsquo;ve followed these steps but feel like you still need some support or guidance, your insurer may be able to help. At Sovereign Insurance, insurance is just one strategy within our broad risk management solutions that can help you protect your business&rsquo;s bottom line and reputation in the event of a cyber attack. For example, in addition to the financial protection typically provided by technology or cyber policies, Sovereign will provide you with access to breach preparation and crisis management services to help you navigate the complexities of data security. The possibility of a cyber attack doesn&rsquo;t have to be overwhelming when you&rsquo;ve stress tested your plan and know it stands up.
&nbsp;
1 Research Report: "Ninth annual cost of cybercrime study." Accenture, March 6, 2019 2 <a href="https://cybersecurityventures.com/cybercrime-damages-6-trillion-by-2021">"Global Cybercrime Damages Predicted to Reach $6 Trillion Annually By 2021". </a>Cybercrime Magazine, December 7, 2018 3 Media Release <a href="https://aon.mediaroom.com/csuitecyberreport">"Aon report shares C-suite insights as losses from cyber attacks set to reach all-time highs"</a>,&nbsp;accessed December 4th, 2019 4 <a href="https://www2.deloitte.com/content/dam/Deloitte/ca/Documents/risk/ca-en-risk-cyber-5-steps.pdf">"Five essential steps to improve cybersecurity",</a>&nbsp;Deloitte, accessed December 4th, 2019 5 Burley, Ron "<a href="https://www.cpomagazine.com/cyber-security/how-cybersecurity-leaders-can-best-navigate-the-c-suite/">How Cybersecurity Leaders Can Best Navigate the C-Suite"</a> CPO Magazine, September 13, 2019 6 "<a href="https://blog.rsisecurity.com/best-practices-for-testing-your-cyber-incident-response-plan">Best Practices for testing you Cyber Incident Response Plan"</a> RSI Security, February 8, 2019 7 Reichenberg, Nimmy "<a href="https://www.siemplify.co/blog/testing-incident-response-processes/">Putting Your Incident Response Processes to the Test"</a> Siemplify, July 8 , 2018

How to stress test your business for cyber resiliency

Despite the rise of automation and artificial intelligence technologies, the vast majority of business that gets conducted relies on some sort of human interaction or connection. Employees are an organization&rsquo;s greatest asset, but also remain every organization&rsquo;s weakest link when it comes to defending against a cyber breach. You can implement the latest firewall technology and employ a genius Chief Information Officer, but if all staff members aren&rsquo;t aware of the types of scams that cyber criminals are trying to pull, then chances are your organization could fall victim to a social engineering attack.
<h4>What is social engineering?</h4>
Simply put, social engineering is a form of psychological manipulation that targets the user rather than the computer itself &ndash; and it&rsquo;s proving to be very effective for cybercriminals. It plays on our universal human traits of fear, trust and conformity to get access to information, all without hacking into a system or cracking a code or password.
Your first line of defense might be to invest in antivirus software and firewall (software and physical versions) with intrusion detection capabilities &ndash; and that&rsquo;s a great start. But that won&rsquo;t account for human weaknesses, like a lack of attention to detail or an all too trusting nature.
<h4>The impact on your business</h4>
If organizations don&rsquo;t take measures to educate and train their employees on social engineering tactics, it&rsquo;s more likely that they&rsquo;ll fall for scams, get hacked, experience a breach and become the victim of fraudulent wire transfers. Any of these events can be incredibly costly and could impact the company&rsquo;s reputation. And this can be repeated multiple times if the bad guys find a &lsquo;good victim&rsquo;. In addition to the monetary impact, being scammed doesn&rsquo;t feel good and can take an emotional toll on your employees.
<h4>Phishing tactics</h4>
Phishing is a technique where cybercriminals send fake emails, texts or websites that look like legitimate correspondence to manipulate employees into gaining access to corporate systems or information. It uses social engineering tactics by deceptively preying on employees&rsquo; emotions and relying on them to mistakenly hand over access to target information.
A phishing breach usually occurs when a hacker gets the structure of an organization&rsquo;s email addresses and then sources a list of names of company employees, usually from LinkedIn or the company&rsquo;s own website.
Similarly, a cybercriminal could get the log in details to a company executive&rsquo;s email address and send out emails to other employees directly from that account. They could then either request sensitive information or ask them to send wire transfers on behalf of the company. In many cases, the employee receiving that email will think the request is legitimate and provide the sensitive information or transfer the funds.
Another form of phishing sees hackers send out emails &ndash; again appearing to be from a legitimate email address &ndash; containing a link or attachment.
That link can do a couple of different things: it can send them to a web page with a form which asks them to provide personal information, it can include spyware to gather information on the company (and its employees and clients), or it can include a ransomware file attachment which activates when downloaded. That file will encrypt the files on the user&rsquo;s computer and only unencrypt them when a ransom is paid to the criminal&rsquo;s bank account.
<h4>Tips to protect your business</h4>
Social engineering is something that can be mitigated if employees are well educated. Your first line of defense might be to invest in antivirus software and firewall (software and physical versions) with intrusion detection capabilities &ndash; and that&rsquo;s a great start. But that won&rsquo;t account for human weaknesses, like a lack of attention to detail or an all too trusting nature. That&rsquo;s why it&rsquo;s so important to educate employees on social engineering and phishing, and the specific tactics they should look out for. This can help foster a culture in which employees are alert and cautious with information whether they&rsquo;re online or in-person.
Encourage employees to follow the steps below to reduce the chances of social engineering impacting your organization:
<ul>
<li>Avoid opening emails from unknown email addresses</li>
<li>Create better, stronger passwords &ndash; and change them regularly</li>
<li>Avoid less than reputable internet sites, web and smartphone applications</li>
<li>Cut down on the amount of biographically accurate information you divulge online (e.g. listing your birthdate on social media)</li>
<li>Only use trusted sites when online</li>
<li>Don&rsquo;t click on links you&rsquo;re sent. Instead, open the webpage on your own by typing in the URL yourself to make sure you&rsquo;re going to a legitimate site and not a phishing scam site</li>
<li>Log out of Facebook and other social media accounts when you&rsquo;re not using them and before you close your browser window</li>
<li>Don&rsquo;t choose &ldquo;save my password&rdquo; or &ldquo;remember me&rdquo; when logging onto any type of account, as these credentials can be stolen by hackers</li>
<li>Follow the company&rsquo;s &ldquo;new vendor/account change&rdquo; protocol to verify clients before sending wire transfers above a certain predetermined threshold. This could involve requiring employees to call vendors (using the phone number in your files, not the one in the email) before making the transfer.</li>
</ul>

Social engineering: your business is at risk from human blunders

Managing Risk

Infographic

About us

Diversity and Inclusion

Newsroom

Media Kit

Claims

Contact us

Team-building exercises in the workplace can help build trust among employees, improve camaraderie, and increase collaboration, innovation, and morale. These are many of the same goals that DEI (diversity, equity, and inclusion) programs aim to achieve, so it&rsquo;s well worth integrating DEI into your next team-building event.
In fact, when organizations incorporate DEI into team-building events, they can help to foster a greater understanding of the diverse backgrounds and experiences of employees, which in turn can cultivate greater empathy and respect.1
DEI team-building ideas
There are many ways to not only celebrate diversity at your organization, but also cultivate a better appreciation for and understanding of DEI within your organization. Here are some DEI themed ideas to consider incorporating into your next teambuilding event:
Guest speakers: Bring in guest speakers who specialize in DEI topics, such as cultural awareness, understanding stereotypes, and unconscious bias. Events can be held in person or online but be sure to leave time afterward for questions and discussion among employees.2
DEI book club: A fun way to explore different viewpoints is through a book club, where books are chosen based on DEI themes such as race, gender, disability, etc. Make sure the books selected are engaging (you don&rsquo;t want it to feel like homework) and give employees plenty of time to read the book (at least a month). Then hold an in-person or virtual meeting to discuss.3
Team-building games: Games aren&rsquo;t just fun; they can be educational. A trivia session, for example, can be done either in-person or with remote teams. By divvying employees up into teams and encouraging friendly competition, the event will be more engaging&mdash;helping employees retain what they learn. The idea is to highlight lesser-known facts about DEI to encourage discussion and learning.4
Celebrations: Year-round, organizations can honour observances such as Black History Month (February), Mental Health Awareness Month (May), Pride Month (June) and Women&rsquo;s History Month (October), as well as a diverse range of religious and cultural holidays.5 These could be ideal times to share educational resources, demonstrate allyship, and amplify the voice of non-profits or charitable organizations working in this space.
Volunteer: Another option is to offer volunteer opportunities for employees&mdash;as a team&mdash;in the community, such as serving food to the unhoused or helping at a charity event, which can create camaraderie while fostering greater understanding and empathy for others.
<h4>Sovereign: DEI in action</h4>
Sovereign Insurance put DEI into action during a team-building event at its 2023 Claims Conference in Calgary, which brought together 52 team members from across Canada. The conference&rsquo;s theme, &lsquo;The power of connection,&rsquo; emphasized the importance of building strong relationships with peers and with the community.
One of the highlights of the conference was a team-building activity that included participants simulating accessibility challenges. By experiencing first-hand the limitations of loss of sight, hearing, or touch, the team gained a better understanding of the widespread need for differently abled and disability accommodations.
The team also built wheelchairs for the Calgary Drop-in Centre, to create a meaningful and tangible impact for the community. As a result, nine wheelchairs were donated to those in need, and the team was proud to show their commitment to diversity and inclusion.
&ldquo;For our Claims Conference, we wanted to select an activity that allowed us to both collaborate as a team and reflect upon our commitment to making a positive impact in our communities,&rdquo; says Larissa Maclean, Assistant Vice-President of Claims at Sovereign Insurance.
&ldquo;The challenge activities supported our ongoing commitment to DEI, allowing us to gain insight into the challenges faced by those who are differently-abled, and resulted in the donation of nine wheelchairs to a local organization&mdash;a win-win!&rdquo;
These activities were organized through <a href="https://www.outbackteambuilding.com/">Outback Team Building &amp; Training</a>, a team building and employee training provider in North America that offers more than 60 team-building and training solutions endorsed by thousands of corporate groups across North America.6
&nbsp;
Sources:
1 &ldquo;15 Fun Diversity Team Building Activities&rdquo; (Teamland, accessed Jan. 16, 2024). <a href="https://www.teamland.com/post/fun-diversity-team-building-activities">15 Fun Diversity Team Building Activities (teamland.com)</a>
2 Angela Robinson; &ldquo;18 Virtual Diversity And Inclusion Activities For Workplaces&rdquo; (teambuilding.com, Oct. 24, 2022). <a href="https://www.teamland.com/post/fun-diversity-team-building-activities">15 Fun Diversity Team Building Activities (teamland.com)</a>
3 Collin Waldoch; &ldquo;Diversity and inclusion Team Building Activities (10 Options), (Water Cooler Trivia, Apr. 1, 2022). <a href="https://www.watercoolertrivia.com/blog/diversity-and-inclusion-team-building-activities">Diversity And Inclusion Team Building Activities (10 Options) (watercoolertrivia.com)</a>
4 &ldquo;15 Fun Diversity Team Building Activities&rdquo; (Teamland, accessed Jan. 16, 2024). <a href="https://www.teamland.com/post/fun-diversity-team-building-activities">15 Fun Diversity Team Building Activities (teamland.com)</a>
5 Grace He; &ldquo;Diversity and Inclusion Activities &amp; Ideas for the Office in 2024&rdquo; (teambuilding.com, Dec. 12, 2023). <a href="https://teambuilding.com/blog/diversity-and-inclusion-activities">Diversity and Inclusion Activities &amp; Ideas for the Office in 2024 (teambuilding.com)</a>
6 Outback Team Building, accessed Jan. 16, 2024. <a href="https://www.outbackteambuilding.com/">The #1 Corporate Team Building Company | Outback Team Building</a>

DEI-themed ideas for your next team-building event

Purpose And Impact

In a traditional industry like insurance, change can sometimes happen at a gradual pace. But there&rsquo;s one emerging technology many businesses might be wise to move quickly on: Generative AI.
Hailed as a transformative force in business, Generative AI (GenAI) refers to deep-learning models that can generate high-quality text, images and other content based on the data they were trained on.1 While GenAI&rsquo;s roots trace back to the early days of artificial intelligence in the 1950s, the technology burst on the public scene in 2022, when OpenAI launched a consumer-facing GenAI tool called ChatGPT.2
In the insurance sector, experts say GenAI is &ldquo;fundamentally reshaping everything from underwriting and risk assessment to claims processing and customer service.&rdquo; More specifically, GenAI tools &ldquo;have the potential to automate processes, enhance customer experiences and streamline claims management, ultimately driving efficiency and effectiveness across the industry.&rdquo;3
In the Canadian Underwriter 2024 National Broker Survey, sponsored by Sovereign Insurance, brokers were asked how beneficial certain changes or investments have been in their organizations. Just over a fifth (21%) of respondents said using artificial intelligence and machine learning tools such as ChatGPT have been highly beneficial to them. Brokers were also asked how beneficial certain investments and actions have been for strengthening their business. Twenty-two percent of brokers indicated AI and machine learning tools have been highly beneficial on that front.&nbsp;
While it&rsquo;s still early days for generative AI, there&rsquo;s no doubt brokers and carriers alike are thinking about how they can harness the power of GenAI across their operations. Here&rsquo;s a look at a few key areas where the sector can leverage AI.&nbsp;
Claims management: For carriers, one promising application is in claims management, says Ricky Chan, Senior Solution Architect at Sovereign Insurance. &ldquo;Generative AI can help automate claims processing and assessment, which in turn increases adjusters&rsquo; productivity, allowing them to focus their expertise on more complex claims,&rdquo; he says.&nbsp;
Underwriting: GenAI can also help inform underwriting decisions. As Accenture notes, the technology highlights risk control analysis insights to show loss prevention measures in place and the effectiveness of those controls. Generative AI can generate a comprehensive narrative of the overall risk and its alignment to the carrier&rsquo;s appetite and book, as well as identify and source missing data.4
Submissions: For brokers, GenAI has a variety of promising use cases, such as submission preparation and client Q&amp;As. According to Accenture, the effort required to identify adequate coverage and prepare submissions can be dramatically reduced through GenAI. Specifically, the technology can prompt the broker on the types of questions they should ask based on what is known about the insured, the industry the insured operates in, and the risk profile of the insured&rsquo;s company compared to others. In addition, GenAI could identify potentially overlooked up-sell or cross-sell opportunities.5
Information and knowledge: For any company, GenAI can make day-to-day work life easier by performing administrative tasks and knowledge gathering, an area that Sovereign is currently exploring. &ldquo;There are substantial positive impacts to day-to-day operations, such as summarizing information and meeting minutes, intelligent information search and ease of access of information,&rdquo; says Ricky.&nbsp;
Chad Hunter, Vice-President, Information Technology at Sovereign Insurance, adds that Sovereign &ndash; like many companies &ndash; uses a handful of different platforms and domains, including e-mail, OneDrive, SharePoint and Microsoft Teams. By using a natural language chatbot or co-pilot tool, the company&rsquo;s knowledge and data could be streamlined. For example, &ldquo;instead of underwriters having to go to several different spots looking for knowledge, they could use the chatbot&hellip; and behind the scenes, that generative AI model will go to all the different areas and provide real-time responses,&rdquo; explains Chad.&nbsp;
What&rsquo;s next for GenAI? Beyond just talking about the possibilities of the technology, many companies in the insurance space &ndash; Sovereign included &ndash; are now testing and learning. Looking ahead, Deloitte notes that as generative AI moves from possibilities to practicalities, choosing the right use cases, selecting appropriate tools, getting to scale, and accurately measuring progress will all be important steps.6

Sources&nbsp;
1 IBM, &ldquo;<a href="https://research.ibm.com/blog/what-is-generative-AI">What is generative AI?</a>&rdquo; April 20,2023 2 Medium, &ldquo;<a href="https://matthewdwhite.medium.com/a-brief-history-of-generative-ai-cb1837e67106">A Brief History of Generative AI</a>,&rdquo; Jan. 7, 2023 3 EY, &ldquo;<a href="https://www.ey.com/en_us/insights/insurance/how-insurers-can-leverage-the-power-of-generative-ai">How insurers can leverage the power of generative AI</a>,&rdquo; Aug. 28, 2023 4 Accenture, &ldquo;<a href="https://insuranceblog.accenture.com/3-ways-insurance-underwriters-gain-insights-generative-ai">3 ways insurance underwriters can gain insights from generative AI</a>,&rdquo; March 21, 2024 5 Accenture, &ldquo;<a href="https://insuranceblog.accenture.com/5-key-generative-ai-use-cases-in-insurance-distribution">5 key generative ai use cases in insurance distribution</a>,&rdquo; Feb. 13, 2024 6 Deloitte, &ldquo;<a href="https://www2.deloitte.com/content/dam/Deloitte/us/Documents/consulting/us-state-of-gen-ai-report-q2.pdf">Now decides next: Getting real about Generative AI</a>,&rdquo; April 2024

Why the insurance sector should keep step with GenAI 

Hot Topics

Even the most advanced technologies and significant investments in cybersecurity can&rsquo;t fully protect businesses from a major cyber risk: their own employees.
In the 2024 Voice of the CISO report by cybersecurity firm Proofpoint, 74% of survey respondents said human error is their most significant risk when it comes to cyberattacks. This finding is echoed in a 2023 study by Verizon, which found that human error is indeed a factor in 74% of total breaches, despite ongoing efforts by enterprises to strengthen their defences and increase training in cybersecurity.1,2
Employee training can fall short for several reasons: distractions in the workplace, a lack of awareness about the critical role employees play as the first line of defence, and the challenge of staying on top of the evolving threat landscape, to name a few.3
Small- and medium-sized businesses (SMBs) face an even bigger challenge: They might not have the resources to conduct employee training in the first place, relying instead on third parties to support their security measures. This can be a costly mistake.
Despite the perception that cybercriminals only target large corporations, certain types of attacks, such as social engineering, are more frequently aimed at small businesses. These companies are typically not financially prepared for an attack, and it could even put them out of business. According to IBM&rsquo;s 2023 Cost of a Data Breach Report, the average cost of a data breach on organizations with fewer than 500 employees is US$3.31 million.4,5
<h4>Simple steps for employee training in SMBs</h4>
While it may not be feasible for SMBs to regularly conduct extensive employee training sessions, mitigation strategies don&rsquo;t have to be complex. There are simple and cost-effective measures that can be easily understood and adopted, making it possible for SMBs to strengthen their cybersecurity efforts.
Make employees aware of the critical role they play: First and foremost, employees must understand the &ldquo;why.&rdquo; According to a 2023 survey by the Insurance Bureau of Canada, many employees underestimate the role they play in being cyber safe at work and the impact of potential cyberattacks on their employer. Nearly half (47%) believe technology plays more of a role in protecting their workplace from cyber threats than they do; 30% believe their employer is solely responsible for protecting the organization from cyber threats; and 31% do not believe cyber criminals would target them.6
Whether it&rsquo;s in the form of interactive workshops or channels like emails and posters, employers should regularly communicate security awareness to staff. When they are aware of the importance of cybersecurity and their role in safeguarding their company, employees are more likely to take this issue seriously and report suspicious activities.7,8
Educate employees about common and evolving threats: Educating staff about different types of cyberattack, how to spot them, and how to respond to them is crucial for protecting against breaches. Recognizing phishing tactics, for example, includes identifying suspicious emails, unusual requests, and fake websites. Staff should also be clear on who to contact if they encounter a suspicious message. In a social engineering attack, cybercriminals may mimic the writing style of a CEO to trick an employee into sending money. In this case, businesses should have dual controls in place, meaning a second person should verify the request.9,10
As part of awareness training, SMBs can take advantage of free online resources, such as webinars, toolkits, articles and e-learning courses from cybersecurity organizations like the <a href="https://www.cyber.gc.ca/en/small-medium-businesses" target="_blank" rel="noopener">Canadian Centre for Cyber Security</a> and the <a href="https://www.unb.ca/cic/webinars.html" target="_blank" rel="noopener">Canadian Institute for Cybersecurity</a>, the Government of Canada&rsquo;s <a href="https://www.getcybersafe.gc.ca/en/resources/get-cyber-safe-guide-small-businesses#C7" target="_blank" rel="noopener">Get Cyber Safe</a> platform, as well as cybersecurity firms.
Other ways to keep employees informed are through newsletters with tips, news about recent threats and best practices; informal lunch-and-learn lessons where employees can share news and insights; and a database or guidebook where employees can stay up to date on the latest threats and find answers to their cybersecurity questions.11,12,13
Nurture a cybersecurity culture: A strong culture of cybersecurity &ndash; meaning it&rsquo;s entrenched in the company&rsquo;s values &ndash; is essential. SMBs should lead by example, showing the company is committed to cybersecurity at all levels. This makes employees more likely to follow suit. Since employee engagement is a key element of building a cybersecurity culture, business leaders should also recognize and reward employees who demonstrate good practices.14
Another way to build a strong cybersecurity culture is to speak employees&rsquo; language. Experts advise communicating in plain language, avoiding technical jargon and focusing on practical advice employees can use daily. For example, rather than using the term &ldquo;multi-factor authentication,&rdquo; they can explain there is an extra layer of security when logging in.15
Additionally, fostering open communication and a &ldquo;no-blame culture&rdquo; is essential. Employees should feel comfortable asking questions, reporting suspicious emails and voicing concerns without fear of reprisal.16
While SMBs may face resource constraints, the cost of not investing in cybersecurity &ndash; even in the simplest of ways &ndash; is far greater. By prioritizing employee awareness and creating a strong cybersecurity culture, businesses can turn their weakest link into their strongest line of defence.
&nbsp;
&nbsp;
Sources
1 Proofpoint, &ldquo;<a href="https://www.proofpoint.com/us/newsroom/press-releases/proofpoints-2024-voice-ciso-report-reveals-three-quarters-cisos-identify" target="_blank" rel="noopener">Proofpoint&rsquo;s 2024 Voice of the CISO Report Reveals that Three-Quarters of CISOs Identify Human Error as Leading Cybersecurity Risk</a>,&rdquo; May 21, 2024
2 Verizon, &ldquo;<a href="https://www.verizon.com/about/news/2023-data-breach-investigations-report" target="_blank" rel="noopener">2023 Data Breach Investigations Report: frequency and cost of social engineering attacks skyrocket</a>,&rdquo; June 6, 2023
3 Skillsoft, &ldquo;<a href="https://www.skillsoft.com/blog/why-security-training-fails-and-how-to-fix-it" target="_blank" rel="noopener">Why Security Training Fails And How To Fix It</a>,&rdquo; June 3, 2022
4 &nbsp;StrongDM, &ldquo;<a href="https://www.strongdm.com/blog/small-business-cyber-security-statistics" target="_blank" rel="noopener">35 Alarming Small Business Cybersecurity Statistics for 2024</a>,&rdquo; Feb. 1, 2024
5 Business.com, &ldquo;<a href="https://www.business.com/articles/smb-budget-for-cybersecurity/" target="_blank" rel="noopener">The Cost of Cybersecurity and How to Budget for It</a>,&rdquo; Aug. 13, 2024
6&nbsp; Insurance Bureau of Canada, &ldquo;<a href="https://www.ibc.ca/news-insights/in-focus/ibcs-research-suggests-business-owners-and-employees-could-be-putting-their-organizations-at-risk" target="_blank" rel="noopener">Are you cyber savvy? IBC&rsquo;s research suggests business owners and employees could be putting their organizations at risk</a>,&rdquo; Nov. 6, 2023
7 LinkedIn, &ldquo;<a href="https://www.linkedin.com/advice/1/you-need-communicate-security-awareness-your-ob68f" target="_blank" rel="noopener">You need to communicate security awareness to your employees. What are some effective ways?</a>&rdquo;
8 FasterCapital, &ldquo;<a href="https://fastercapital.com/content/Train-your-employees-on-cybersecurity.html#The-Importance-of-Cybersecurity-Training-for-Employees" target="_blank" rel="noopener">Train your employees on cybersecurity</a>,&rdquo; June. 4, 2024
9 Pure IT, &ldquo;<a href="https://www.pureit.ca/five-ways-small-businesses-can-stop-a-cyber-breach-from-ever-happening/" target="_blank" rel="noopener">Five Ways Small Businesses Can Stop A Cyber Breach From Ever Happening</a>&rdquo;
10 Teal, &ldquo;<a href="https://tealtech.com/blog/cybersecurity-awareness-training-for-employees/" target="_blank" rel="noopener">5 Ways to Promote Employee Cybersecurity Awareness Training</a>,&rdquo; July 25, 2024
11 Mitnick Security, &ldquo;<a href="https://www.mitnicksecurity.com/blog/remote-security-tips" target="_blank" rel="noopener">Remote Security: 5 Cyber Security Tips for Employees and Businesses</a>,&rdquo; Feb. 22, 2024
12 The AME Group, &ldquo;<a href="https://www.theamegroup.com/headlines/engage-employees-to-increase-cyber-safety/" target="_blank" rel="noopener">Engage Employees To Increase Cyber Safety</a>&rdquo;
13 &nbsp;Compyl, &ldquo;<a href="https://compyl.com/blog/cybersecurity-awareness-training-for-small-business/" target="_blank" rel="noopener">Getting Started With Cyber Security Awareness Training for Small Business</a>,&rdquo; Sept. 5, 2024
14 Babylon Solutions, &ldquo;<a href="https://www.babylonsolutions.com/cybersecurity-guide-for-small-businesses-how-to-protect-your-company/" target="_blank" rel="noopener">Cybersecurity Guide for Small Businesses: How to Protect Your Company</a>,&rdquo; Oct. 7, 2024
15 SMB Solutions: &ldquo;<a href="https://www.smbsolutions.com.au/10-easy-steps-to-building-a-culture-of-cybersecurity-awareness/" target="_blank" rel="noopener">10 Easy Steps to Building a Culture of Cybersecurity Awareness</a>,&rdquo; Aug. 23, 2024
16 Tripwire, &ldquo;<a href="https://www.tripwire.com/state-of-security/cultivating-cybersecurity-culture" target="_blank" rel="noopener">Cultivating a Cybersecurity Culture</a>,&rdquo; Jan. 23, 2024

Spot a phish, protect your business

Spot a phish, protect your business

You may also like

Connect with us

Let's stay in touch