--- title: "Remember \"Do No Harm\" with Security Awareness" description: Security awareness budgets are limited. It is tempting to focus activities based on data. With biased data, we may end up discriminating and poor results. image: https://blog.cybercoach.com/hubfs/do-no-harm-preview.png --- [![CyberCoach Full Logo with Bot Icon](https://blog.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg)](https://www.cybercoach.com?hsLang=en) - PRODUCT ## CyberCoach at a glance An industry-changing platform built on peer-reviewed research: phishing, secure coding, and AI skills training, delivered directly in Teams, Slack, or the browser. ### [The Science Behind CyberCoach Why traditional phishing simulations don't work, according to peer-reviewed research from ETH Zurich.](https://www.cybercoach.com/science-behind-cybercoach?hsLang=en) ### [Is Phishing Simulation Legal Under GDPR? 9 steps GDPR requires before you phish your employees — and a new simulation approach that doesn't need any of them.](https://www.cybercoach.com/legal-basis-phishing-simulation?hsLang=en) ### [Pricing Flexible plans, also monthly.](https://www.cybercoach.com/pricing?hsLang=en) ### [Blog Latest insights into security awareness and what's new with CyberCoach.](https://blog.cybercoach.com) ### [Customer Stories Read more about how CyberCoach has helped organizations across different industries modernize their approach to security and AI training.](https://www.cybercoach.com/customer-stories?hsLang=en) ### [OT Security Training Targeted training for employees working with OT technology.](https://www.cybercoach.com/ot-security-training?hsLang=en) - [AI TRAINING](https://www.cybercoach.com/ai-security-training?hsLang=en) ## [AI Training The most comprehensive role-based AI security and productivity training — built to help employees use AI effectively and safely, and keep your organization compliant with the EU AI Act.](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [AI Security Training Why choose CyberCoach for your AI security training needs?](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [EU AI Act Training Requirements: What You Actually Have To Do AI literacy training has been mandatory since February 2025.](https://www.cybercoach.com/eu-ai-act-training-requirements?hsLang=en) - [FOR DEVELOPERS](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ## [For Developers Go beyond OWASP Top10 and offer hands-on interactive training for technical roles in secure coding and efficient use of AI.](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ### [Secure Coding Skills Meet ISO/IEC 27001 or SOC 2 requirements for secure development practices with no-nonsense training for your developers and other technical roles, directly in Microsoft Teams or Slack chat.](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [COMPANY](https://www.cybercoach.com/about-us?hsLang=en) ## [About us We're growing into the most diverse training platform company on the planet.](https://www.cybercoach.com/about-us?hsLang=en) ### [About Us Get to know our international team.](https://www.cybercoach.com/about-us?hsLang=en) ### [Contact Us Get in touch.](https://www.cybercoach.com/contact-us?hsLang=en) ### [Careers We are hiring.](https://www.cybercoach.com/careers?hsLang=en) ### [Partner with us Learn more about our partner program.](https://www.cybercoach.com/partnerships?hsLang=en) [FREE TRIAL](https://www.cybercoach.com/free-trial?hsLang=en) [GET A DEMO](https://meetings-eu1.hubspot.com/maria-bique/cybercoach-demo?uuid=88959d26-2ff7-4dd0-8ebd-dd43eb31443e) Awareness # Remember "Do No Harm" with Security Awareness Security awareness budgets are limited. It is tempting to focus activities based on data. With biased data, we may end up discriminating and poor results. [Maria Bique](https://blog.cybercoach.com/author/maria-bique) Feb 21, 2023 [Awareness](https://blog.cybercoach.com/tag/awareness) [Cyber Social Responsibility](https://blog.cybercoach.com/tag/cyber-social-responsibility) ### Share this article [mailto:?subject=Check%20out%20https://blog.cybercoach.com/do-no-harm-with-security-awareness&utm_medium=social&utm_source=email%20&body=Check%20out%20https://blog.cybercoach.com/do-no-harm-with-security-awareness&utm_medium=social&utm_source=email](mailto:?subject=Check%20out%20https://blog.cybercoach.com/do-no-harm-with-security-awareness&utm_medium=social&utm_source=email%20&body=Check%20out%20https://blog.cybercoach.com/do-no-harm-with-security-awareness&utm_medium=social&utm_source=email) ### Subscribe ### Subscribe ![](https://blog.cybercoach.com/hubfs/do-no-harm-preview.png) Developing security awareness and culture should be data driven. But with the wrong data, we risk doing more harm than good. Let’s look at a dangerous example of how biased data could lead to wrong actions. **Who falls for phishing—pervasive data biases still in 2023** Keynote talk on stage at a hacker conference. Speaker riles up the crowd trying to get them to guess who is most likely to click on links in phishing messages. The over 90% white male crowd in black hoodies cheers when the answer turns out to be “*young females*.”  Speaker did not cite the source, but the fact is the science is still out.\* Even the studies that suggest women may be more susceptible to phishing attempts, attribute this difference to women having less technical training and experience with computers. The same seems true for age. There are conflicting studies and there is just not enough data. Other factors seem to be stronger predictors. Women, elderly and young people are all receiving less security training.  **What’s the harm in biased data?** We want facts that help us fine-tune and target our security controls and measures. When we say things like *“young people / young women / women are more likely to click on phishing links”,* we ignore the actually useful information out there and take biased data as a fact. What happens when we take biased data as a fact, and start implementing controls and measures that target young women? We end up discriminating and doing harm, with poor results. We do not end up fixing the root problem of security training not being inclusive and available to all equally. It is long overdue for us to stop reinforcing old stereotypes, even if our data might suggest that they still exist. Many of us are engineers and we like simple solutions to simple problems. Here, the problem is not simple, and the solution is even less so. Even if we had reliable data that some demographic was making lots of mistakes, does that kind of profiling really serve us in any useful way? Only if we view raising cybersecurity awareness as policing, rather than teaching and training. We need to shift focus from trying to figure out "who got this wrong" and instead normalize and encourage mistakes in training environments.  My fear is that the (predominantly male) engineers in the audience went to work the next day and considered increasing monitoring and tightening controls for young female colleagues. Instead of thinking: - How could they make their security awareness training and messaging more inclusive? - How are they hampering diversity in cybersecurity by alienating women and other minorities, when even the company stickers represent white men? (The pic above is of a bunch of stickers I received at the above hacker conference, before I got depressed and started rejecting the overly testosterone-y ones.) It really is time for us to re-think how we do security awareness. Cyber defense may be about finding and fighting the bad guys, but security awareness is not. It is about education, empathy and support. Even the current industry standard phishing training has been shown to be potentially counterproductive.\*\* We badly need more industry diversity for designing more inclusive and effective training. We also need to all speak up against these types of dated demographic studies and not let them lead to more harmful discrimination. Sources \*Literature review of contradicting findings in studies trying to understand the demographics of phishing susceptibility: D. Jampen, G. Gür, T. Sutter, and B. Tellenbach, “Don’t click: towards an effective anti-phishing training. a comparative literature review,” Humancentric Computing and Information Sciences, vol. 10, no. 1, pp. 1–41, 2020. \*\*D. Lain, K. Kostiainen and S. Čapkun, "Phishing in Organizations: Findings from a Large-Scale and Long-Term Study," *2022 IEEE Symposium on Security and Privacy (SP)*, San Francisco, CA, USA, 2022, pp. 842-859, doi: 10.1109/SP46214.2022.9833766. ## Similar posts Security Culture ### [Guide to Security Awareness Training for Finance Roles](https://blog.cybercoach.com/guide-to-security-awareness-training-for-defending-financial-data?hsLang=en) Accountants often handle sensitive financial data, making them attractive targets for cybercriminals. What awareness topics should you be training... Maria Bique Feb 29, 2024 Cybersecurity ### [Why we Adopted the 4-day Workweek (and Why You Should Too)](https://blog.cybercoach.com/why-we-adopted-the-4-day-workweek?hsLang=en) We believe that with a 4-day work week we’re really working to cultivate diverse talent and challenge what a cybersecurity startup does and looks... Dana Paredes Mar 2, 2023 Work-Life-Balance ### [Get to Know the CyberCoach Team – Juulia Hellgren](https://blog.cybercoach.com/get-to-know-the-cybercoach-team-juulia-hellgren?hsLang=en) Get to know the CyberCoach Team. First we will introduce you to Juulia and what does she feel about sales and the 4-day work week. Dana Paredes Jun 13, 2024 ### Get notified of what's going on in AI and security awareness and compliance **Expert Tips:** Stay informed with curated content, expert opinions, and case studies that are relevant to your organization's security awareness strategy. **Special Offers:** Access to CyberCoach promotions and campaigns.  **Stay Informed:** Get the latest insights and updates on security and AI compliance trends, threats, and best practices delivered directly to your inbox. ![cybercoach\_logo\_white.svg.2023\_03\_15\_16\_58\_04.0](https://blog.cybercoach.com/hubfs/cybercoach_logo_white.svg.2023_03_15_16_58_04.0.svg) ### Product - [For Developers](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [AI Security](https://www.cybercoach.com/ai-security-training?hsLang=en) - [Manage Subscription](https://billing.stripe.com/p/login/28o4jRclF4gab1C6oo) - [FAQ](https://www.cybercoach.com/faq?hsLang=en) ### Connect - [Partner Program](https://www.cybercoach.com/partnerships?hsLang=en) - [Careers](https://www.cybercoach.com/careers?hsLang=en) - [For Media](https://www.cybercoach.com/media?hsLang=en) - [Contact Us](https://www.cybercoach.com/contact-us?hsLang=en) ### Legal - [Privacy](https://www.cybercoach.com/cybercoach-website-privacy?hsLang=en) - [General Terms](https://www.cybercoach.com/general-terms?hsLang=en) ### Company - [About Us](https://www.cybercoach.com/about-us?hsLang=en) - [Blog](https://blog.cybercoach.com) - [ESG Policy](https://www.cybercoach.com/esg-policy?hsLang=en) © 2026 CyberCoach All rights reserved ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Maria Bique", "url" : "https://blog.cybercoach.com/author/maria-bique" }, "dateModified" : "2024-10-04T19:17:49.690Z", "datePublished" : "2023-02-21T18:13:38.000Z", "headline" : "Remember \"Do No Harm\" with Security Awareness", "image" : [ "https://blog.cybercoach.com/hubfs/do-no-harm-preview.png" ], "mainEntityOfPage" : { "@id" : "https://blog.cybercoach.com/do-no-harm-with-security-awareness", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.cybercoach.com/hubfs/cybercoach_marketplace_icon.svg" }, "name" : "CyberCoach" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#organization", "@type" : "Organization", "foundingDate" : "2019", "legalName" : "Cult Security", "logo" : "https://www.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg", "name" : "CyberCoach", "sameAs" : [ "https://www.linkedin.com/company/cult-security", "https://x.com/cybercoachUS", "https://www.instagram.com/cybercoachus/", "https://www.youtube.com/@CyberCoachOfficial" ], "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#software", "@type" : "SoftwareApplication", "applicationCategory" : "BusinessApplication", "applicationSubCategory" : "Security awareness and AI skills training", "availableLanguage" : [ "English", "Spanish", "Portuguese (Brazil)", "Portuguese (Portugal)", "French", "Dutch", "German", "Swedish", "Finnish" ], "description" : "CyberCoach is a role-based security awareness, privacy and AI skills training platform that runs as a conversational app inside Microsoft Teams, Slack or a web browser. Employees practice AI skills and responding to social engineering in short, psychologically safe scenario-based sessions. Learning is anonymous while successful completions are recorded per user so the organization can evidence training completion for compliance. CyberCoach can also run on pseudonymous identifiers such as Slack or Microsoft UUIDs, with no personal data shared with CyberCoach.", "featureList" : [ "Conversational phishing and social engineering challenges", "Role-based training programs for technical and non-technical roles", "AI security and AI use training", "Secure coding training for developers", "OT security training", "Custom content creation", "Compliance assessments (ISO/IEC 27001, GDPR, AI compliance)", "Anonymous learning with per-user completion records for compliance", "Optional pseudonymous deployment using Slack or Microsoft UUIDs" ], "name" : "CyberCoach", "offers" : [ { "@type" : "Offer", "description" : "Cover the basics.", "name" : "Starter", "price" : "49", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Broad topic coverage, custom content, hosted kick-off.", "name" : "Advanced", "price" : "159", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Full coverage, 24/7 AI chat, compliance assessments, hosted kick-off.", "name" : "Complete", "price" : "179", "priceCurrency" : "EUR" } ], "operatingSystem" : "Microsoft Teams, Slack, Web browser, iOS, Android", "publisher" : { "@id" : "https://www.cybercoach.com/#organization" }, "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is a security awareness, privacy and AI skills training platform that runs inside Microsoft Teams, Slack or a web browser. Employees practice role-based skills such as responding to social engineering, ethical and productive use of AI and even secure coding skills in short conversational scenarios. Learning is anonymous, while successful completions are stored so the organization can evidence training completion for compliance frameworks such as ISO/IEC 27001 and SOC 2." }, "name" : "What is CyberCoach?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, but not by sending deceptive emails to employees. CyberCoach uses conversational phishing challenges in which employees practice recognizing and responding to social engineering scenarios in Teams, Slack or the browser. Peer-reviewed research, including Lain et al. (ETH Zurich, 2022 and 2024), finds that traditional email-based simulated phishing does not reduce risk and can increase misplaced trust in the inbox." }, "name" : "Does CyberCoach do phishing tests?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Learning is anonymous: how an employee answered a training scenario is never visible to managers or administrators. What is recorded is successful completion, so the organization can evidence who has completed required training for compliance purposes. This is privacy by design: the sensitive part of the interaction stays private, and only the completion fact is retained." }, "name" : "Are individual employee answers visible to managers?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. CyberCoach can be deployed using pseudonymous identifiers, such as Slack or Microsoft UUIDs, so no personal data is shared with CyberCoach. Compliance reporting still works: the mapping between a UUID and a real person is resolved only for authenticated and authorized administrators within the customer's own organization." }, "name" : "Can CyberCoach be used without sharing personal data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach supports security awareness and secure development training requirements under ISO/IEC 27001 and SOC 2, and includes assessments covering ISO 27001, GDPR and AI compliance on the Complete plan." }, "name" : "Which compliance requirements does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is available in English, Spanish, Portuguese (Brazil), Portuguese (Portugal), Polish, French, Dutch, German, Swedish, Norwegian, Danish and Finnish, with more languages in development." }, "name" : "Which languages does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Plans start at 49 EUR per month for Starter, 159 EUR per month for Advanced and 179 EUR per month for Complete, available monthly or yearly, including through the Microsoft Azure Marketplace." }, "name" : "How much does CyberCoach cost?" } ] } ```