The motivation for this paper comes from experience working on the security team and taking opportunities to engage with employees to build the partnership between the security team and employees. While conducting in-person presentations, giving public acknowledgements, and other, more personalized, security awareness experiences – the organization saw an increase in willingness to openly discuss security as well as selfreport certain incidents. There was an interest in getting more data around the effects of these initiatives. A survey with knowledge-based and attitude-based questions was first conducted to check competency of those who had the more personalized experience versus those that did not. The competency scores from that survey did not show much of a difference when provided these more personal communications versus just the typical video presentations to cover security training compliance requirements. But on the attitude-based questions, there was data that showed that most individuals preferred that personal experience. This majority response led the company to review employee reporting over the course of three years - where these, seemingly more personal, engagement activities fluctuated and so did employee response - which shows that although personal touches may not lead to higher competency scores, they will lead to higher motivation to communicate and partner with the security team in general. And after all, what an organization should really be after is not only high competency scores but rather instilling employees with the confidence and motivation to act during what could seem like or be a potential crisis or security incident.

Recommended Citation: Wescott J., Clark U., Vetter R., Stoker G., Wetherill W., (2021). A Look at Security Awareness Training, Engagement and Employee Motivation. UNCW MS CSIS Proceedings. V. 15 , N. 2 .