Cyber Security Starts with People: Why Awareness Training and Upskilling Must Be a Priority

02 May, 2025 Gavin Hall

While businesses invest heavily in advanced technologies like next-generation firewalls and threat intelligence platforms, they often overlook a critical component of their cyber defence strategy: people.

Despite robust technological safeguards, the human element remains the most vulnerable link in the security chain.

The Business Case for Investing in Awareness Training

Cyber threats are continually evolving, and so must your workforce’s ability to recognise and respond to them.

A 2024 survey by Fortinet revealed that 70% of organisations believe their employees lack fundamental cyber security knowledge. Alarmingly, even among companies that have implemented security awareness training, 79% still experienced human-related data breaches in the past year.

This highlights the need for training programmes that are not only comprehensive but also engaging, measurable, and continuously updated.

Real-World Cyber Incidents that Emphasis the Cost of Inaction

Recent cyber incidents in Australia reinforce the consequences of inadequate cyber security awareness:

Rockhampton Grammar School Data Breach (September 2024): The school inadvertently emailed confidential medical information of 18 primary school students to parents of another grade while preparing for an excursion. This incident underscores the risks associated with mishandling sensitive data and the importance of stringent information management protocols. (Courier Mail)
Sydney Hospital Business Email Compromise (November 2024): A Sydney hospital lost $2 million to a business email compromise scam, where attackers exploited human trust to redirect payments. (Kirby ID)
Services Australia Data Breaches (2024): There was a significant surge in data breaches due to social engineering attacks, with 49 incidents reported by July 2024, up from nine in 2023. Scammers used stolen personal information to access customer accounts, highlighting vulnerabilities in human-centric security protocols. (The Guardian Australia)

Awareness Training Is Not Optional — It’s Strategic Risk Management

The NSW Information and Privacy Commission reported that 79% of data breaches between November 2023 and June 2024 were due to human error. The most common issue was sending emails to the wrong recipient. It’s a clear reminder that cyber resilience starts with people, not just technology.

A workforce well-versed in identifying phishing attempts, social engineering tactics, and other cyber threats serves as a robust first line of defence. This is particularly crucial in sectors such as healthcare, finance, and legal services, where sensitive data is abundant and regulatory requirements are increasingly stringent.

From Awareness to Upskilling: Building Internal Cyber Capability

Beyond basic awareness, ensuring that everyone across the business is cyber trained is essential for mitigating risks. Offering comprehensive training, including mock phishing attempts and regular reporting, is an effective way to foster a culture of vigilance against cyber threats.

At Diamond IT, we support organisations in developing and implementing cyber security awareness training & simulated phishing exercises. These initiatives not only help reduce the risk of human error but also support compliance with frameworks like ISO 27001, the Essential Eight, and Australian privacy regulations.

Our Cyber Security Awareness Training includes

By prioritising continuous education for all employees, organisations can strengthen their overall security posture and better protect against potential threats.

What Business Leaders Should Do Next

Conduct a Cyber Security Assessment: Identify and understand the human-centric risks within your organisation.
Implement Human Risk Management Strategies: Develop behaviour-driven programmes that monitor and adapt to employee behaviour.
Ensure Continuous and Measurable Training: Utilise phishing simulations and compliance dashboards to track progress and effectiveness.
Invest in Comprehensive Upskilling: Empower key personnel with the skills necessary to manage internal security measures effectively.
Integrate Training into Risk Management: View cyber awareness as a proactive approach to reducing operational, reputational, and financial risks.

Cyber Security Culture Starts at the Top

Leadership must champion the importance of cyber security awareness and training. Technology alone isn’t enough, it requires a culture where every team member is vigilant and informed. Investing in your people now means you’re investing in your organisation’s future cyber resilience.

Contact our team today on 1300 307 907 or fill out the form below if you need expert guidance on where to begin cyber awareness and upskilling in your organisation.