Security Awareness Training Improves Cyber Vigilance
IT security teams are staying in closer contact with the campus community, McCormack said.
“Our cybersecurity teams and leaders are increasingly sensitive to the needs of the individual,” he said. “What work are they trying to get done? What is the student trying to accomplish? How can we factor that into how we design and support our security needs so that we're not just viewed as a barrier? We're helping to enable their work in a safe way.”
The EDUCAUSE Top 10 emphasizes the need to balance strong cybersecurity measures with autonomy and trust of the individual. Institutions are doing what they can to protect student and institutional data via technology and security strategies, but they’re also realizing the value of making sure the campus community stays vigilant against cyberthreats. Cybersecurity awareness training is a key element of this strategy.
At Washington University in St. Louis, the cybersecurity team is trying to move beyond training as a compliance exercise.
“We serve more than 40,000 brilliant scholars, physicians, students and staff working at the frontiers of discovery, and they carry an enormous cognitive load,” said Quint Smith, director of the Information Security Awareness, Behavior and Culture (ABC) Program. “We treat them as capable, extremely busy partners in protecting the systems and data that drive innovation at our institution.”
The team’s approach includes tailored messaging, hands-on activities and training timed to the academic and clinical calendar. The team found data showing that annual training does not meaningfully reduce phishing attacks.
READ MORE: Building cyber resilience around risk protects institutions.
“Cognitive load theory reminds us that working memory is limited, people do not like passive, repetitive content like once-a-year training videos,” said Christina Pomianek-Smith, information security analyst at WashU. “Instead of building a security mindset, we may be unintentionally training people to ignore us.”
The team conducted a study comparing traditional hourlong cybersecurity training sessions with microlearning modules delivered at different intervals. Early data from the study has shown that participants prefer monthly training and that those who received monthly training were less likely to open or click through phishing simulation emails. Monthly training also had the highest compliance rate, at around 75%.
“Our monthly group included the most people streaming, had the lowest click rate of simulated phishing, and rated their experience the highest,” Smith said. “We also saw microlearning participants use the phishing alert button. The ABC program is moving all participants to a monthly model. We chose the one people prefer, and that that keeps security in front of them most often.”
DISCOVER: Quantifying cyber risk can help justify technology investments.
IT Support Teams Build Trust With End Users
At Yale University, the human-centered approach starts with recognizing that faculty are not a single kind of IT user. Higher education institutions are full of diverse users with a range of needs and comfort levels. A humanities professor and a chemistry professor might have completely different relationships to technology. Yale’s frontline support team recognizes this and is organized around discipline zones, tailoring its offerings accordingly.
“Our role is to translate complex systems into practical solutions that people can rely on in their daily work,” said Rachel Feinmesser, associate director of IT. “That requires more than just technical knowledge; it requires listening, empathy and an understanding of what people are actually trying to accomplish.”
That distinction changes how support staff respond. In one example Feinmesser shared, a faculty member’s trouble accessing files could have prompted a quick link to instructions. Instead, a technician investigated the person’s actual workflow, learned that files were spread across devices and storage locations, and developed visual cues to help. The ticket stayed open for 28 days — not because the team was slow, but because the client needed time to test whether the solution worked.
LEARN MORE: Year-round learning requires always-on support.
Feinmesser also described IT as a partner in keeping research moving. In one case, a lab facing high data storage costs wanted to use a personal storage server. The support team coordinated with networking and information security to assess whether the approach would fit Yale’s systems, then helped migrate the data.
“When we understand the people behind the problems, we don’t just resolve the tickets; we strengthen the research community itself,” she said.
Feinmesser described frontline support’s role as acting like a concierge, connecting users to the people and resources on campus that can help them meet their goals. Communication is an integral part of that service, not an extra step.
“Communication is often the key to saving any interaction, even if what you have to convey is bad news,” she said.
IT staff should meet users at their level of technical knowledge, Feinmesser said. Don’t use technical jargon that will go over their heads, but don’t talk down to those who have technical backgrounds. Keep clients informed when work is delayed, and close the loop rather than assuming a fix is complete. The goal, she said, is to leave people with understanding, confidence and trust.
Click the banner below to subscribe to our weekly newsletter.
