“We developed the shirts in consultation with Awareways,” Michel quickly adds. “I thought your ransomwear campaign was very well thought off!” The resulting garments are a memorable way to reward the best-performing team, but physically displaying the victory also helps his security team to keep the subject in the spotlight.
“For a larger target group within the organization, it is a very original and unique way to keep security awareness on the agenda. By ‘wearing’ security themes, they become open for discussion on the shop floor. Attention is the first step towards conscious behaviour.”
The now completed De Heus Protector campaign is part of the broader security awareness program that De Heus rolled out together with Awareways, about which we shared a testimonial earlier. “In recent months, all of our international business units took part in an intensive challenge with microlearnings,” Michel explains. Phishing exercises have also been conducted again. The goal: to increase awareness and sustainably change behavior. “It was an intense traject, with multiple rounds. Myanmar eventually emerged as the winner, and naturally that had to be rewarded.”
“We didn't know beforehand who would win,” says Michel, “and wanted to come up with a fitting reward for that. Myanmar was one of the countries that excelled in a competition that was taken very seriously all around. That competition component really makes the difference: they even made a day of it to all work on it. The fact that it is experienced in that way means that you can really make changes from within the culture.”
That visibility was reinforced in Myanmar by the way the campaign was experienced. “The feedback from senior management is also very positive.”
Measurable effects, human results
Although awareness is difficult to quantify, De Heus sees clear signs that the approach is working. Phishing simulations show improvement: employees click less and report suspicious emails more often. “We see that people prefer to report too much rather than too little,” says Michel. “And that is exactly what you want: a message when there is nothing going on, instead of the reverse: no reaction when a wrong link has actually been clicked.”
Internal measurements also show progress. Compared to the baseline measurement at the start of the collaboration, the first follow-up measurement already showed improvement. The scores show that employees understand the rules and risks demonstrably better. Employees also indicate that they are better capable of recognizing incidents ánd know how to act. This comparison provides proof that investing in security awareness and propagating it pays off. As an international organization, De Heus has taken a measurable step forward: employees have more knowledge, exhibit more secure behavior and are more motivated than at the starting point. The second measurement is currently running.
