Hidden in Onboarding: Cyber Hygiene Training and Assessment

End-users are our first line of defense against cyber-attacks. The U.S. government has endorsed training videos that teach cyber hygiene best practices, aiming to harden our defenses. In this pilot study, we explored the effectiveness of those security training videos under the cover of an employee onboarding scenario and general computer competency questions. Masking the cybersecurity focus of this study was critical to prevent unnatural heightened vigilance. For example, increased awareness of cybersecurity threats can artificially increase sensitivity to phishing emails or identify malicious links. Participants’ cyber hygiene knowledge was assessed by pre- and post-tests after receiving the training. In addition, we measured behavioral onboarding task performance based on the training learning objectives. Our findings showed a lack of improvement in quiz knowledge and onboarding security activities after exposure to the training. We echo others in the literature by claiming the need for a paradigm shift in how traditional cybersecurity training is taught and how success is measured.