What are the best ways to engage execs in high-level cybersecurity training?

Sponsored by

Your AI strategy has a security problem: 43% of IT leaders now cite security concerns as the top barrier to expanding AI agent deployment, according to research from JumpCloud. Before giving agents more access to apps, data, and workflows, make sure you can govern the identities behind them. See how to secure every identity, human or not.

For many employees, cybersecurity training is a quarterly video warning them not to click on mysterious links. For senior executives, though, helping defend against internal and external threats can involve simulations, tabletop exercises, and intensive group activities—which can take a lot of time.

But what happens when executives claim they’re too busy running the company to actually participate? How can IT teams ensure that leadership actually locks in for the big defensive plan?

Timing is key. Tim Rawlins, director and senior adviser at NCC Group, suggested the best time for busy executives’ cybersecurity training is in conjunction with board meetings and other big corporate events that place the C-suite in the same room.

“The fact that they are there to make strategic decisions, they are there to manage senior stakeholders, and they are there to approve communications, we drum that into them,” Rawlins said. “You get them in the room, you identify who is in the room…because you want to figure out, have you got the right people in the room.”

The real world. Ramy Rahman, a senior solutions engineer at ArmorCode, said some of the most impactful training programs for executives are war room exercises, where a company simulates an attack. Those exercises are paired with training for ways different people in the company can mitigate that risk.

In many instances, Rahman said, a cybersecurity team can act as an attacker to show executives the “path of risk and the art of the possible.” Once executives see what an attacker’s potential path into the company’s data would look like, they can train to mitigate risk.

“Those war room simulations need to take those real world scenarios and stories and apply them to the current state,” Rahman said. “The best security consultants, the best security personas and professionals, are the ones that are great storytellers.”

Revamp the training. Rahman suggests three steps for cybersecurity and IT professionals wanting to adjust their training protocol.

First, cybersecurity pros should make preparation exercises relevant to their audience, to the point of including a company’s branding and relevant intellectual property into the training if necessary.

“It makes it relevant because then it creates some ownership,” Rahman said. “It feels like home base, it doesn’t feel like some external entity coming in to try to tell you what to do.”

Second, Rahman said professionals should leverage company-approved AI to help give executives information on how to respond to cybersecurity threats. For example, a company could empower the C-suite to ask whether a suspicious situation should be reported to IT.

Third, Rahman suggested professionals place a strong emphasis on documenting procedures and policies, along with tools: “That documentation piece gets left behind or it gets out of date, and now more than ever you can improve that documentation by leveraging AI to actually scale.”