What Is an Example of a Negative Cybersecurity Culture?

A joint study from Stanford University Professor Jeff Hancock and security firm Tessian revealed that 9 in 10 (88%) data breach incidents are caused by employees’ mistakes. This means that most cyber threats don’t stem from sophisticated hackers but rather from internal human errors—often due to poor security awareness, weak leadership commitment, or inadequate training.

Let’s imagine Acme Holding LLC, a large, well-established financial services company with 3,000 employees across multiple offices globally. Despite its size, Acme Holding has struggled to build a positive cybersecurity culture, leading to severe security challenges.

This blog post explores how a negative cybersecurity culture can manifest at Acme Holding LLC and why it leaves the organization vulnerable to cyber threats.

1. Lack of Leadership Commitment

At Acme Holding, the CEO and senior management rarely discuss cybersecurity. Security awareness is treated as an IT issue, not a business priority. Employees notice that leadership:

• Uses weak passwords and ignores multi-factor authentication (MFA)
• Doesn’t participate in phishing simulations or cybersecurity awareness training
• Focuses more on profitability than protecting sensitive data

When leadership fails to prioritize cybersecurity, employees follow their example. Organizations with strong executive involvement in cybersecurity experience fewer security breaches and lower financial losses.

A strong security culture must start at the top, with leadership actively promoting and enforcing best practices.

For a deeper look into how leadership influences security culture, read the Keepnet blog on Where Does Security Culture Stand for Executives?

2. Employee Neglect and Disengagement

Employees at Acme Holding are disengaged from cybersecurity initiatives. There is little effort to encourage security awareness, resulting in:

• No clear process for reporting phishing emails or suspicious activities.
• Employees click on phishing links because they are unaware of the risks.
• No follow-up or feedback when security concerns are reported.

This lack of engagement creates a dangerous blind spot for the organization. Employees, instead of being the first line of defense, become an open gateway for cyber threats, allowing phishing, ransomware, and social engineering attacks to bypass security controls with ease.

Gamified security training makes learning interactive and engaging, helping employees retain information and apply it effectively. To see how this approach enhances security awareness, explore Keepnet's blog on The Power of Gamification in Security Awareness Training.

3. Inadequate or Outdated Cybersecurity Training

Cybersecurity training at Acme Holding is inconsistent and outdated. Employees are required to complete a single annual training session, which is:

• Boring and outdated, failing to address emerging threats like quishing (QR code phishing)
• Not reinforced, causing employees to forget critical security best practices
• Viewed as a compliance checkbox, rather than an essential skill-building exercise

Without ongoing and engaging training, employees remain unprepared for real-world cyber threats, increasing the risk of phishing, vishing, and social engineering attacks.

A more effective approach involves interactive, AI-driven training tailored to modern attack methods and employee behavior patterns.

Check out Keepnet’s Security Awareness Training, which stands out by combining a scientific behavior change model, AI-driven phishing simulations, and executive reporting to reduce high-risk security behaviors by up to 90%.

4. Lack of Collaboration Across Departments

At Acme Holding, cybersecurity is seen as the IT department’s sole responsibility, with little involvement from other teams. However, cyber threats impact every department, and when employees outside IT are not engaged in security discussions, risks multiply.

Without cross-departmental collaboration:

• The marketing team falls victim to social engineering scams, exposing sensitive company and customer data.
• The HR department mishandles employee records, increasing insider threats and compliance violations.
• The finance team unknowingly processes fraudulent transactions, leading to financial losses and reputational damage.

A lack of teamwork in cybersecurity creates dangerous blind spots, as employees outside IT may not recognize cyber threats or follow security best practices. By integrating security awareness into all business units, organizations can build a culture of shared responsibility, reducing human-driven risks.

Keepnet Extended Human Risk Management Platform can help track, analyze, and improve security behaviors across all teams, ensuring that cybersecurity is embedded into daily operations.

To further strengthen enterprise security, organizations should empower cybersecurity ambassadors—employees across departments who advocate for best practices and act as security role models. Read more about this approach in the Keepnet blog on The Role of Cybersecurity Ambassadors in Improving Enterprise Security Posture.

5. Complicated or Ineffective Security Tools

Acme Holding has invested in security tools, but instead of strengthening cybersecurity, these tools are creating frustration and inefficiency.

Employees find them:

• Difficult to use, resulting in low adoption rates.
• Slow and time-consuming, discouraging employees from reporting security threats.
• Restrictive, leading employees to bypass security controls to complete their tasks faster.

When security tools slow down workflows or are too complex, employees often find workarounds, unintentionally creating security gaps. This increases the risk of human errors and data breaches.

Organizations must implement user-friendly security solutions that seamlessly integrate into daily tasks, enhancing security without disrupting productivity.

To understand the psychology behind why employees bypass security policies and turn to unapproved tools (Shadow IT), explorer blog on Why Employees Bypass Policies: The Psychology Behind Shadow IT.

6. Closed Communication and No Feedback Loop

Acme Holding does not encourage open discussions about cybersecurity, leading to a lack of trust in the reporting process. Employees feel:

• Uncomfortable reporting security concerns due to fear of blame.
• Frustrated when reports go unacknowledged and unresolved.
• Disconnected from security initiatives, resulting in low engagement.

Without a transparent reporting culture, security threats can go undetected and unaddressed, allowing attackers to exploit vulnerabilities.

Organizations must establish a safe and supportive reporting system where employees feel confident and valued when sharing security concerns.

To understand the psychology behind why employees hesitate to report insider threats, read our blog on Why Do Employees Fail to Report Insider Threats? Understanding the Psychology Behind Inaction.

The Consequences of a Negative Cybersecurity Culture

At Acme Holding LLC, a weak cybersecurity culture leads to serious risks, affecting financial stability, reputation, and compliance. Key consequences include:

• More phishing and ransomware attacks – Employees fail to spot phishing emails, allowing hackers to steal data or install ransomware, disrupting business operations.
• Regulatory fines and compliance violations – Not following laws like GDPR, HIPAA, or PCI-DSS can result in heavy fines and legal action.
• Loss of customer trust and brand damage – A data breach can drive customers away, harming the company’s reputation and revenue.
• Higher cyber insurance costs – Insurers charge higher premiums to companies with weak security practices, increasing financial strain.

Without a strong security culture, Acme Holding LLC will continue to face cyber threats, financial losses, and reputational harm.

To learn how organizations can build a security-conscious workplace, read Keepnet blog on Building a Security-Conscious Corporate Culture: A Roadmap for Success.

How to Transform a Negative Cybersecurity Culture

To strengthen cybersecurity culture, organizations must:

• Ensure leadership commitment: Executives should actively engage in security initiatives
• Provide engaging, ongoing training: Interactive Security Awareness Training is critical
• Encourage employee participation: Use a Phishing Simulator to reinforce phishing detection skills
• Improve collaboration across departments: Cybersecurity should be everyone’s responsibility
• Simplify security tools: Adopt user-friendly solutions that integrate seamlessly into workflows
• Foster open communication: Encourage reporting security threats without fear of blame

By taking these steps, organizations can transform their cybersecurity culture, reducing risks and strengthening their overall cyber resilience.

To ensure a strong cybersecurity culture, organizations should implement a Security Behavior and Culture Program (SBCP). This approach focuses on changing employee habits, reinforcing security awareness, and integrating cybersecurity into everyday workflows. By addressing both human behavior and organizational practices, SBCP helps create a sustainable, security-first mindset across all levels of the business.

Learn more about how SBCP can strengthen cybersecurity culture in What is a Security Behavior and Culture Program (SBCP)?