Awareness, social engineering and security culture

Make secure behaviour possible

Awareness draws attention to issues and expected behaviour; training develops knowledge or skills for a task. A learning program should reflect audiences, responsibilities and changing needs. Completion counts and attendance are evidence of participation, not proof that a person can perform a task competently.

Recognize manipulation and report it

Social engineering uses people and context to influence actions. Phishing may impersonate a familiar service, exploit urgency or request credentials or payment. Tailgating concerns gaining unauthorized physical access by following someone through a controlled entrance; impersonation concerns pretending to hold a trusted identity or role. Use established verification and reporting routes rather than relying on a message’s logo or a person’s confidence.

Leadership affects reporting and improvement

A workable culture encourages people to raise concerns and learn from mistakes. Leaders need suitable resources, clear expectations and useful information about obstacles. Blame or unrealistic demands can suppress reporting. Combine learning needs and feedback with observed outcomes; a high report count can reflect better reporting rather than a worsening attack rate.

Include suppliers in the expectations

The selected ENISA concepts add that suppliers with access to important data or systems need clear, agreed security expectations and active oversight. This is a proportionate governance principle, not a complete procurement or legal-compliance lesson.

Keep verification useful when messages improve

Editorial application: a persuasive, well-written message is not proof of a trusted sender or authorized request. Apply the same approved verification and reporting process when a message may have been generated or personalized with AI. Improve the process and training using evidence, rather than assuming every suspicious message is AI-generated.

Connect the terminology.