Cybersecurity Awareness Training

This is concept project is designed to help every non-tech employee adopt strict cybersecurity culture and practices, by gaining a deeper understanding  of how security breaches happen and how they can affect them personally and the company in everyday situations.

This is an expanding project, and the first module presented here showcases a fully interactive, 15-minute instructional module focused on modern password hygiene. It represents the first completed section of a larger security curriculum covering phishing, VPN use, social engineering, and device safety.

• Client (Fictional): Helios Financial Group

• Audience: Non-technical employees across operations, support, and finance

• Project: Password Security module of a comprehensive Security Awareness Training Program

• Responsibilities: Action mapping, storyboarding, visual & graphic design, eLearning development & instructional design, User testing and iteration, Creating a long-term plan for future modules in the series.

• Tools used: MindMeister (action-mapping), Canva (visual elements), Pixabay (sound effects & music), Midjourney (AI-generated images), Google sheets (storyboard),Genially (visual mockups, prototype, full eLearning module). The free version allowed rapid prototyping of animations, transitions, and interactivity. With the full Genially license, the module can be exported as SCORM/xAPI and integrated into LMS platforms for tracking, scoring, and reporting.

The Problem

Helios Financial Group is a global company had suffered several security breaches in different branches across the US and Europe in a 6-month period. Upon investigating, they discovered patterns of weak password habits, credential reuse, and poor threat recognition among employees, despite the fact that the company does have a standard, yearly security training which is mandatory for all employees.

Business Needs Analysis

Upon conducting a Business Needs Analysis, two problems were identified: 

• The existing training was text-heavy and ineffective, and most employees found it too abstract, resulting in minimal adoption of secure behaviors.

• Employees  who were  surveyed and attended focus groups demonstrated little knowledge  regarding how security breaches happen, the different tactics used by hackers and cybercriminals, how the password mechanisms and other security habits prevent attacks, and how insecure habits could affect not only the company but their personal lives as well. They followed security protocols out of habit but it was clear they did not prioritize them or realize their true importance.

 A learning solution was clearly identified, in the form of an eLearning course that could be implemented remotely across all branches.

The Solution

Overall Goal: Improve real-world behaviors related to password creation, management, and daily security habits.

Measurable Goal: Reduce human-related security incidents by 60% within 12 months.

Challenge: Instill a sense of importance, seriousness and high-priority for security-related practices in the minds of the employees. 

Solution: use content that employees can relate to at a personal level, and which demonstrates the effects of good cybersecurity habits and the consequences of the lack of such. Help them understand how the security mechanisms help protect them and the company, by explaining the way in which hackers and cybercriminals operate and are able to access private information.

Challenge: Pack a large amount of information into a single training, while maintaining attention and stimulating retention.

Solution: because it was determined that employees need to gain a deeper understanding of cybersecurity practices, a scenario-based module in Articulate 360 was ruled out, in favor of an information-heavy tool. Articulate Rise would have been the next-best option, but its limited interaction capabilities were not suitable for constant engagement and stimulation, necessary for maintaining learner's attention. Genially was the tool of choice, as it allows for both information-rich slides, while using a variety of interactions and media, suitable for both attention and retention.

My Process

Analysis: One of my main goals for this concept project, is to underline the importance of always implementing the very first point in the ADDIE model: Analysis. Even though security trainings are an essential aspect of any organization and creating new material is an obvious solution, finding out the root cause of the problem and taking the right approach to address it is vital to create a successful, learner-centered solution. Without it, the underlying root cause in this scenario (general apathy and lack of interest by the average employee) wouldn't have surfaced, and the learner's need for not only a security protocol, but one that provides learners with both a deeper understanding and the motivation to prioritize online security, wouldn't have been taken into consideration, which could produce an ineffective training solution as a result. In my experience, we can't truly define the problem until we empathize with the audience, and this can only  be done by placing ourselves in their shoes. For this specific scenario, Attention and Relevance were key factors

A key step to establishing needs, business goals and objectives for the learning experience, Action Mapping is not only extremely effective and keeps all stakeholders on the same page, but it also saves precious time! MindMeister is the tool of choice, as it allows for remote collaboration for all stakeholders and teams. For this hypothetic scenario, a 2-hour meeting was held with the participation of all stakeholders and SMEs, and a first-draft of the objectives was established on the spot, parting from the central business need that was stated by the client.

Once the objectives are established and prior to producing any prototypes, a storyboard was sent to SME's for approval. I favor spreadsheets over word documents for the creation of storyboards, for their versatility and visual appeal. 

Attention and retention require stimulation, especially when it comes to information-heavy material eLearnings. In order to make it fun and interesting, this cybersecurity module was set in a cyberpunk visual setting, using bold, high-contrast colors with dark-blue as the main background color.

Computer chips, circuits and computer language are recurring visual elements, with lemon-yellow, light-blue and white providing contrast and highlighting elements. Bright red and Bright green were used to indicate danger/safety respectively.

Background music and sci-fi sound effects for interactions were added, however since the genially free version was used to create this module, there were limitations for things like video and auto-play voiceover. This project will be updated in the future to be SCORM-compliant using the full version.

Visual Mockups & Interactive Prototype