The Role of Cognition in Developing Successful Cybersecurity Training Programs – Passive vs. Active Engagement

End-user cybersecurity, and the risks associated with it, are receiving more and more attention, particularly in organizational settings. This increase in attention has led to a growing body of research on how to mitigate end-user error through cybersecurity training, as well as the implementation of training programs in many organisations across the world. Unfortunately, training programs currently found in the academic landscape and within organisations fail to adequately specify the mechanisms of behaviour that are required of the end-user. This article outlines an alternative approach that differentiates between different kinds of cybersecurity behaviours – those requiring continuous active engagement from the user, and those that can become more passive and habitual over time. To this end, current cybersecurity training approaches and their limitations will be outlined, followed by a brief exploration of habit theory and habit creation. Subsequently, the level of engagement needed for specific cybersecurity behaviours is analysed. In addition, practical approaches to training design, as well as areas for future research are highlighted.