Employers have been urged to measure cybersecurity training effectiveness by changes in employee behaviour rather than course completion rates, as growing cyber threats expose weaknesses in workplace security practices.

Governance Director and Principal Cyber and Information Security Adviser at Black Arrow Cyber Consulting, Bruce McDougall, said human resources departments must work with line managers to reinforce cybersecurity policies, assess whether employees apply what they learn and build confidence in reporting suspicious activities.

He warned that employees were increasingly becoming targets of cybercriminals, who impersonate trusted contacts through emails, workplace messaging platforms and telephone calls, exploiting routine business relationships to gain access to company systems.

The warning followed a cyberattack on online fashion retailer ASOS, which disclosed that an attacker obtained an employee’s login credentials by impersonating a trusted contact. The company said it immediately restricted access to the affected platforms after discovering the incident.

The development highlighted the growing challenge facing employers as increasingly sophisticated attacks make it harder for workers to distinguish legitimate communications from fraudulent requests.

McDougall said cybersecurity training should go beyond meeting organisational requirements and focus on whether employees can recognise threats and respond appropriately in their daily work.

He recommended that organisations use phishing simulations to help workers practise identifying and reporting suspicious messages, rather than treating failed tests as grounds for punishment or additional compulsory training.

He said such exercises should build employees’ confidence in spotting potential attacks and encourage early reporting before incidents escalate.

Other cybersecurity experts also called for security procedures to be integrated into everyday working practices, warning that employees were more likely to bypass policies they considered complicated or inconvenient.

Anastasia Voronkova, insights analyst at Mindtools Kineo, said awareness alone did not guarantee safer behaviour, urging employers to tailor training to the specific risks employees faced in their roles.

She also advised organisations to examine whether excessive workloads, confusing procedures and unclear guidance contributed to unsafe practices, rather than automatically attributing security incidents to individual negligence.

Global Cybersecurity Adviser at ESET, Jack Moore, said employees should verify unexpected requests through separate communication channels before sharing sensitive information or responding to instructions that could compromise company systems.

He also stressed the importance of creating a workplace culture where employees can report mistakes promptly without fear of disproportionate punishment.