Cybersecurity Awareness Month: Your People Are Part of Your Defense

When business owners and managers think about cybersecurity, they often picture firewalls, antivirus software and secure computers. Those tools are essential. But protecting a business also means preparing the people who use its systems every day.

An employee receives an urgent request to reset a password. Someone in accounting gets an email asking for new payment details. A manager receives a message that appears to come from a trusted vendor.

These are everyday situations—and opportunities for attackers.

This Cybersecurity Awareness Month is a good time to ask: Does your team know how to recognize, verify and report a suspicious request?

What the numbers actually tell us

You may have heard that roughly 80% of breaches involve people. That figure has a historical basis: Verizon’s 2022 Data Breach Investigations Report found that 82% of breaches involved the human element.

However, that does not mean 82% of employees fall for phishing or that employees caused every one of those breaches. The category included stolen credentials, phishing, misuse and errors. Verizon’s 2022 report

Verizon’s 2025 report put human involvement at 60% of breaches. That still makes preparing employees a major consideration in a company’s cybersecurity strategy. Verizon’s 2025 report

The useful takeaway is not that people are “the problem.” It is that attackers exploit routine decisions—and employees need support to make those decisions safely.

Awareness training can improve phishing readiness

Effective awareness training gives employees practical skills: recognizing suspicious requests, checking who is contacting them and knowing what to do when something feels wrong.

KnowBe4’s 2025 Phishing by Industry Benchmarking Report analyzed 67.7 million simulated phishing tests across 14.5 million users at approximately 62,400 organizations.

Its customer benchmarking found that average phishing simulation susceptibility fell from 33.1% before KnowBe4 training to 4.1% after a year of ongoing training and testing. KnowBe4’s 2025 findings

These are results from a training provider’s customer data and simulated attacks. They do not establish that every company will achieve the same improvement or that real-world breaches will fall by the same percentage. They do provide a useful example of the improvement associated with sustained training and practice.

For owners and managers, the practical lesson is to make awareness an ongoing part of work.

Why this matters for downtime

A cybersecurity incident can quickly become an operational problem. Employees may lose access to essential systems, customer service may slow down and normal work may stop while the business investigates and recovers.

IBM’s 2024 Cost of a Data Breach research found that 70% of breached organizations experienced significant or very significant disruption. IBM’s 2024 findings

That figure measures disruption following breaches. It does not measure how much downtime awareness training prevents.

The business connection is straightforward: helping employees recognize and report suspicious activity gives the company another opportunity to stop or contain an incident before it affects operations. Training supports that effort alongside technical controls and a prepared response plan.

What useful training looks like

A strong awareness program should reflect the situations your employees actually encounter.

• Use short, regular sessions. Keep security habits familiar throughout the year.

• Teach verification. Show employees how to confirm payment changes, password requests and unusual instructions through a separate, trusted channel.

• Practice realistic scenarios. Include examples relevant to accounting, customer service, management and other roles.

• Make reporting easy. Give employees a clear way to report suspicious emails, messages or calls.

• Encourage early reporting. Employees should feel comfortable reporting a concern—or an accidental click—without fear of embarrassment.

• Include owners and managers. Leadership needs the same preparation and should model the habits it expects from staff.

Measure more than course completion. Look at whether employees recognize suspicious requests, report them promptly and follow verification procedures.

Make awareness part of your cybersecurity defense

Cybersecurity requires technology, people and clear processes working together.

Firewalls and security software protect important parts of your business. Awareness training helps employees respond when a convincing request reaches them.

This Cybersecurity Awareness Month, review whether your team has the knowledge, practice and support to act safely. Then keep that preparation going throughout the year.

Protecting your business means investing in your people as well as your systems.