{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/security-awareness","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/security-awareness/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/security-awareness/"},"term":{"en":"Security awareness","da":"Awareness"},"aka":{"en":["cyber awareness","security awareness training"],"da":["sikkerhedsbevidsthed","cyber awareness"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","summary":{"en":"What staff know about security and how they act on it in daily work.","da":"Medarbejdernes viden om sikkerhed, og hvordan de handler på den i det daglige arbejde."},"body":{"formal":{"en":"The level of understanding employees have of the threats facing the organisation, combined with the habits they show in response - built and kept up through planned training, campaigns and follow-up.","da":"Medarbejdernes forståelse af de trusler, organisationen står over for, sammen med den adfærd, de udviser som svar - opbygget og vedligeholdt gennem planlagt træning, kampagner og opfølgning."},"plain":{"en":"Like teaching everyone in a building where the fire exits are and why the fire doors must stay shut - knowing is only half of it; doing it every day is the point.","da":"Som at lære alle i en bygning, hvor nødudgangene er, og hvorfor branddørene skal holdes lukkede - det er ikke nok at vide det; pointen er, at man gør det hver dag."},"inPractice":{"en":"A school gives security ten minutes at every staff meeting - this month, how to spot a fake MitID login page - and teachers now forward doubtful mails to IT instead of just deleting them.","da":"En skole giver sikkerhed ti minutter på hvert personalemøde - denne måned, hvordan man kender en falsk MitID-loginside - og lærerne sender nu tvivlsomme mails videre til IT i stedet for bare at slette dem."},"whyItMatters":{"en":"Many attacks aim at people rather than machines, and NIS2 lists training among its minimum requirements, so awareness is both a defence and a legal duty.","da":"Mange angreb retter sig mod mennesker frem for maskiner, og NIS2 nævner træning blandt minimumskravene, så awareness er både et forsvar og en lovpligt."}},"deepDive":{"en":"NIST's older guidance, SP 800-16 (1998) and SP 800-50 (2003), both superseded by SP 800-50 Rev. 1 in September 2024, framed learning as a continuum: awareness focuses attention on security and aims at recognition, training builds specific skills for a role, and education integrates skills into a professional body of knowledge. The distinction still matters. Awareness is a population-wide state - can staff recognise a threat and do they know what to do next - whereas training is role-bound, such as secure coding for developers or privileged-access hygiene for administrators. Treating the annual all-staff module as if it were training is a common category error.\n\nThe normative requirements are concrete. ISO/IEC 27001:2022 clause 7.3 requires that people working under the organisation's control are aware of the information security policy, their contribution to the effectiveness of the ISMS including the benefits of improved performance, and the implications of not conforming. Annex A control 6.3, elaborated in ISO/IEC 27002:2022, expects an awareness, education and training programme aligned with policies and topic-specific procedures, updated regularly and covering both new starters and existing staff. NIS2 Art. 21(2)(g) lists basic cyber hygiene practices and cybersecurity training among the minimum risk-management measures, Art. 20(2) requires training for members of management bodies, and DORA Art. 13(6) makes awareness compulsory in financial entities.\n\nMeasurement is the difficult part. The traditional knowledge-attitude-behaviour model assumes that knowledge produces the right attitude, which produces the right behaviour, but the knowing-doing gap is well documented: people who can pass a quiz still click under time pressure. Validated instruments such as the Human Aspects of Information Security Questionnaire (HAIS-Q) measure knowledge, attitude and self-reported behaviour separately, while observed behaviour - reporting rates in real and simulated incidents, time-to-report, policy exceptions, data-handling errors - is the stronger evidence. Large field studies (IEEE S&P 2022 and 2025) found that annual training and embedded post-click lessons had little measurable effect on phishing susceptibility, which is a reason to measure outcomes rather than completions.\n\nAwareness is individual and cognitive; security culture is the collective set of norms that decides whether that knowledge is applied when it is inconvenient. Awareness is necessary but not sufficient: it works best when paired with nudges at the point of decision and with technical controls, such as phishing-resistant MFA, that do not depend on a person noticing anything at all.","da":"NIST's ældre vejledninger, SP 800-16 (1998) og SP 800-50 (2003), der begge blev afløst af SP 800-50 Rev. 1 i september 2024, beskrev læring som et kontinuum: Awareness retter opmærksomheden mod sikkerhed og sigter mod genkendelse, træning opbygger konkrete færdigheder til en rolle, og uddannelse samler færdighederne i en professionel vidensbase. Skellet er stadig vigtigt. Awareness er en tilstand i hele medarbejderstaben - kan medarbejderne genkende en trussel, og ved de, hvad de skal gøre bagefter - mens træning er rollebundet, fx sikker kodning for udviklere eller hygiejne omkring privilegeret adgang for administratorer. At behandle det årlige modul for alle ansatte, som om det var træning, er en udbredt kategorifejl.\n\nDe normative krav er konkrete. ISO/IEC 27001:2022 pkt. 7.3 kræver, at personer, der arbejder under organisationens kontrol, kender informationssikkerhedspolitikken, deres bidrag til ISMS'ets effektivitet, herunder fordelene ved forbedret præstation, og konsekvenserne af ikke at overholde kravene. Kontrol 6.3 i bilag A, uddybet i ISO/IEC 27002:2022, forventer et program for awareness, uddannelse og træning, der er afstemt med politikker og emnespecifikke procedurer, opdateres jævnligt og dækker både nyansatte og eksisterende medarbejdere. NIS2 art. 21, stk. 2, litra g, nævner grundlæggende cyberhygiejne og cybersikkerhedstræning blandt minimumsforanstaltningerne, art. 20, stk. 2, kræver træning af medlemmerne af ledelsesorganet, og DORA-forordningens art. 13, stk. 6, gør awareness obligatorisk i finansielle virksomheder.\n\nMålingen er den svære del. Den klassiske viden-holdning-adfærd-model antager, at viden giver den rette holdning, som giver den rette adfærd, men kløften mellem at vide og at gøre er veldokumenteret: Folk, der kan bestå en quiz, klikker stadig under tidspres. Validerede instrumenter som Human Aspects of Information Security Questionnaire (HAIS-Q) måler viden, holdning og selvrapporteret adfærd hver for sig, mens observeret adfærd - meldeprocent ved rigtige og simulerede hændelser, tid til melding, undtagelser fra politikken, fejl i datahåndtering - er det stærkeste bevis. Store feltstudier (IEEE S&P 2022 og 2025) fandt, at årlig træning og indlejrede lektioner efter et klik havde ringe målbar effekt på modtageligheden for phishing, hvilket er et argument for at måle effekt frem for gennemførelser.\n\nAwareness er individuel og kognitiv; sikkerhedskultur er det fælles sæt af normer, der afgør, om den viden bliver brugt, når det er ubelejligt. Awareness er nødvendig, men ikke tilstrækkelig: Den virker bedst sammen med nudges i beslutningsøjeblikket og med tekniske kontroller som phishing-resistent MFA, der slet ikke afhænger af, at et menneske opdager noget."},"edges":[{"type":"requires","to":"security/threat","confidence":"high","strength":"normal"},{"type":"implements","to":"security/control","why":{"en":"The course glossary counts human measures alongside technical and organisational ones as controls.","da":"Kursets ordliste regner menneskelige foranstaltninger med som kontroller på linje med tekniske og organisatoriske."},"confidence":"high","strength":"normal"},{"type":"implements","to":"security/people-control","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/security-culture","why":{"en":"Awareness is what each person knows and does; culture is the shared habits and attitudes of the whole group.","da":"Awareness er, hvad den enkelte ved og gør; kultur er gruppens fælles vaner og holdninger."},"confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/social-engineering","why":{"en":"People who recognise manipulation are harder to manipulate.","da":"Mennesker, der kan genkende manipulation, er sværere at manipulere."},"confidence":"high","strength":"primary"},{"type":"mitigates","to":"security/phishing","why":{"en":"Trained staff spot and report fake messages instead of acting on them.","da":"Trænede medarbejdere opdager og melder falske beskeder i stedet for at handle på dem."},"confidence":"high","strength":"primary"},{"type":"mitigates","to":"security/pretexting","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/vishing","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/smishing","confidence":"high","strength":"normal"},{"type":"mitigates","to":"ai/deepfake","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-policy","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-50 Rev. 1 - Building a Cybersecurity and Privacy Learning Program","url":"https://csrc.nist.gov/pubs/sp/800/50/r1/final","tier":"standard","publisher":"NIST"},{"title":"ISO/IEC 27002:2022 - 6.3 Information security awareness, education and training","tier":"standard","publisher":"ISO"}],"draft":true}