For most organisations, “security culture” means an annual click-through training course and a phishing simulation email a few times a year. It is treated as a compliance exercise with a completion rate to report to auditors — and measured accordingly: did people finish the module, not whether anything about how they work has changed.
Not a knowledge problem
That approach treats security as a knowledge problem — as if breaches happen because people do not know the rules. In practice, most security failures happen when people who do know the rules are rushing, under deadline pressure, taking a shortcut they have taken before without consequence, or unsure whether reporting a mistake will get them in trouble. A day of training once a year does not touch any of that. Real security culture is what people do under normal pressure when no one is checking — and that is shaped by daily signals, not annual events.
Real security culture is what people do under normal pressure when no one is checking.
What building genuine security instinct requires
01
Leadership visibly modelling the behaviour
Culture follows what leaders are seen doing, not what the training module says. If executives route around a security process because it is inconvenient, no amount of mandatory training outweighs that signal.
02
Making it safe to report mistakes
If someone who clicks a phishing link or misconfigures a system fears blame, they quietly try to fix it themselves or say nothing. A fast, honest report of a near miss is behaviour to reward, not punish.
03
Embedding security into how work already happens
A rule people have to remember separately from their normal workflow will be forgotten under deadline pressure. Security built into the default path — where the secure option is also the easy option — survives a busy Tuesday.
04
Measuring behaviour, not completion
A 98% training completion rate says people clicked through slides. It says nothing about whether they would recognise a real phishing attempt, report a near miss quickly, or push back on an unusual request.
What gets reported
98%
Training completion rate. It shows who finished the course, not how they act.
What tells you more
Phishing report rates
Near-miss reporting volume
Time-to-patch
These show how people act when it counts.
Backed from the top
None of this is something the security team can build alone by producing better training content. It requires visible sponsorship from the CEO and the board. Culture change that is not visibly backed from the top tends to stay exactly what it started as: a compliance exercise with a better name.
Key takeaways
- Most security failures happen under pressure, not because people do not know the rules.
- Leaders set the culture by what they are seen doing, and safe reporting turns mistakes into early warnings.
- Build security into the default path, and measure behaviour rather than completion.
At Percys, we encourage the organisations we work with to ask a simple diagnostic question:
The question to ask
If an employee made a mistake tomorrow, would their first instinct be to report it immediately, or to hope no one notices?
The honest answer says more about security culture than any completion rate ever will.
RELATED READING
