Impact of employee cybersecurity training on knowledge of best practice for secure passwords and use of public Wi-Fi

There is widely recognized challenge to improve cybersecurity awareness and understanding in the workforce. In this paper we assess the impact of cybersecurity training in the workplace on an individual’s awareness of basic cybersecurity best practice. We report the results of a survey ( n = 965 ) of individuals resident in the UK, who’s cybersecurity knowledge was assessed on two key dimensions: secure passwords and use of public Wi-Fi. Despite using a forgiving definition of best practice we find that only 8.6% of participants correctly identified best practice. Around a half of participants had received cybersecurity training through their current employer with a mix of online training, in-person training and training outside the workplace. We find that those who received online training were significantly less likely to identify best practice than those with no training. Those who received in-person training and training outside the workplace were no more likely to identify best practice than those with no training. We also measured participants self-assessed familiarity with cybersecurity and confidence in spotting a phishing attack. We find a positive relationship between training and self-assessed familiarity and confidence. Our results, therefore, suggest that training typical training in use increases confidence without improving awareness or end-user behavior.