The Business Case for Engagement

On why engagement is a strategic advantage

Cyber has spent the better part of two decades treating humans as a compliance problem. Policies get written. Slides get polished. An annual awareness model is pushed through the corporate bloodstream like a vitamin nobody asked for. People click through it with the enthusiasm of someone paying a parking fine. A quiz appears at the end. Congratulations. Everyone is now “trained”.

And then someone in finance reuses their password on a dodgy travel site.

if you sit in the CISO chair for long long, you start to recognise the pattern. Not the attack pattern. The organisational one. Millions poured into tooling. Endless debates about endpoint visibility, threat intel feeds, zero trust architecture. Meanwhile, the single most unpredictable and economically significant attack surface in the organisation remains the one sitting in front of the keyboard. Humans.

The most unpredictable attack surface in any organisation is still the one sitting in front of the keyboard.

The industry likes to talk about “human risk”, but we rarely fund or design controls that actually address it. Instead, we treat people like a compliance checkbox. We deliver information and call it learning. We measure completion rates and call it a success. Then we act surprised when behaviour changes not one jot.

For security leaders who care about outcomes rather than theatre… this is where the real business case for engagement begins.

The Expensive Illusion of Awareness

Traditional training survives for one reason. It is easy to administer and easy to measure. But then again, so is your daily dose of vitamin C but that’s never made material change to anyone’s health. Execs see percentage bars creeping towards 100% completion on the nice, tidy dashboard. The board nods approvingly. The risk register gets ticked. But completion is not comprehension. And comprehension is not behaviour.

Cognitive science has been dismantling the foundations of traditional training for years. Even the objectively slow national curriculum has caught up to the concept. When I went to school, we learnt pretty much by rote. Now, my eight year old learns through songs, play, experimenting. And why?

Completion is not comprehension. And comprehension is not behaviour.

Because passive information delivery, particularly in digital slide format, produces notoriously weak retention. Most people forget the majority of what they read within days unless they actively use it, discuss it, or apply it under pressure. Cyber training tends to fail on all three counts.

The typical awareness module asks an employee to absorb a handful of abstract rules. Don’t click suspicious links. Use strong passwords. Report anomalies. Sensible advice, bien sur. But advice delivered without context, tension, or consequence rarely lodges itself in the messy decision making environment of real work. And real work is where attackers operate.

Phishing emails do not arrive when someone is calmly contemplating security best practice. They arrive when that person is juggling meetings, deadlines, inbox chaos, and the vague suspicion that their manager is about to ask where a document has disappeared to. In that moment, cognition narrows. Speed wins over caution. The brain looks for shortcuts.

Attackers know this… whilst security training often ignores it.

The result is a strange corporate ritual. Organisations deliver awareness content that is cognitively detached from the situations it is meant to influence. Employees dutifully complete it. Security leaders present the metrics. Then attackers walk through the same behavioural doorways they have been exploiting for years. The problem here is not knowledge. It is engagement.

Engagement is a Security Control

When we discuss security controls, the conversation tends to orbit around technology. Identity management. Endpoint protection. Network segmentation. Each one a legitimate layer in a modern defence strategy. Yet behaviour remains the common thread that binds them all.

A privileged account misused. A credential reused. A suspicious email trusted. A USB device plugged in. A laptop left unattended. An overshared social media profile quietly providing reconnaissance data to someone halfway across the world. Every one of those moments sits at the intersection of human judgement and organisational culture.

If attackers use engagement as a weapon, defenders should probably use it as a shield.

Treating engagement as a “soft” concept misses the point entirely. In security terms, engagement is a behavioural control. It is the mechanism through which knowledge becomes instinct. It is the difference between recognising a phishing attempt intellectually and actually stopping long enough to question it. And behavioural controls only work when people care enough to pay attention.

Engagement creates that attention. Not through gamified points systems or cheerful badges, but through experiences that make security feel real, immediate, and personally relevant. When people are placed inside a scenario rather than simply told about one, something shifts. Curiosity kicks in… Competitive instincts wake up… Conversations start. Learning becomes participatory rather than passive.

This is why immersive approaches to cyber education are beginning to attract serious attention in organisations that have grown tired of checkbox compliance. When employees are asked to investigate, solve, and respond inside simulated security incidents, the learning experience changes shape.

People remember the moment they nearly trusted the wrong clue. They remember the puzzle that forced them to rethink how passwords work. They remember the colleague who spotted something the rest of the team missed. Memory forms around action and emotion rather than bullet points. In other words, the training finally behaves like the threat environment it is meant to prepare people for.

Protecting the Training Investment

The second half of the business case is financial.

Security awareness programmes are not cheap. Enterprise organisations routinely spend six or seven figures annually across platforms, content libraries, internal campaigns, and staff time. That investment exists for a reason. Regulators expect it. Boards demand evidence of it. Cyber insurance providers increasingly scrutinise it. Yet the truth is that a significant portion of that investment is lost to disengagement.

If employees treat awareness training as a box to tick, the return on investment collapses. Knowledge decays quickly and behaviour remains unchanged. The organisation carries the cost without receiving the risk reduction. From a CISO’s perspective, that is a poor allocation of security budget.

Engagement changes the economics. When people actively participate in learning, retention improves dramatically. Discussion spreads organically across teams. Employees start noticing things they previously ignored. Security stops being something delivered by IT and becomes something experienced collectively. The organisation gets something much rarer than compliance.

It gets attention.

Attention is the currency of modern security. Attackers spend enormous energy capturing it. A cleverly crafted phishing email is essentially an attention trap. A fake login page is a behavioural test. Social engineering campaigns are carefully engineered theatre designed to manipulate curiosity, urgency, and trust. If attackers are using engagement as a weapon, defenders would be wise to use it as a shield.

Immersive learning environments do exactly that. They recreate the tension, ambiguity, and problem solving dynamics of real incidents in a controlled setting. Participants explore clues, collaborate under time pressure, and experience the consequences of decisions. In doing so, they internalise patterns of thinking that traditional training struggles to teach. And crucially, they enjoy the process.

Enjoyment might sound like an odd metric in cybersecurity, but it has powerful implications. When people enjoy a learning experience, they talk about it. They share it with colleagues. They remember it months later. The training spreads culturally rather than remaining trapped inside a compliance portal. That cultural spread multiplies the value of the original investment.

From Awareness to Participation

There is also a broader strategic shift underway in how organisations think about cyber culture. The old model positioned security as an external authority issuing instructions. Employees were expected to follow rules created somewhere else in the organisation. Compliance was the goal.

The newer model treats security as a shared responsibility embedded in everyday work. Employees are not passive recipients of guidance but active participants in defending the organisation. Awareness evolves into participation. Engagement is the bridge between those two worlds.

When teams experience cyber scenarios together, hierarchies flatten slightly. The developer, the finance analyst, and the operations manager all contribute different insights. People realise how small behavioural choices accumulate into larger security outcomes. The conversation shifts from “IT says we should…” to “We noticed something interesting during that exercise…”

That shift matters enormously for CISOs trying to embed security thinking across complex organisations. Technology can enforce controls at the system level, but culture determines what happens in the countless grey areas where rules meet real work. The more people feel involved in security, the more likely they are to pause, question, and report when something looks wrong. And those pauses can be the difference between a blocked phishing attempt and a breach.

The End of the Checkbox Era

None of this means traditional awareness content disappears entirely. Policies still need explaining. Regulations still require documentation. Foundational knowledge still matters. But relying on passive training alone is becoming increasingly difficult to justify.

Threat actors are creative. They experiment relentlessly with new psychological tactics. They build campaigns that feel personal, plausible, and urgent. In comparison, many corporate training programmes remain static, predictable, and disengaging. It is not a fair fight.

The business case for engagement isn’t entertainment. It’s risk reduction.

CISOs who want to close that gap need to rethink the role engagement plays in their defence strategy. Not as a marketing gimmick. Not as a morale booster. As a serious behavioural control with measurable impact on how people make security decisions.

The organisations experimenting with immersive, participatory learning are discovering something interesting. When employees experience cyber threats in a realistic environment, they stop seeing security as an abstract policy and start recognising it as a practical skill. Skills change behaviour. Behaviour reduces risk. And risk reduction, after all, is the entire point.

The business case for engagement is not about making training more entertaining. It is about making security education actually work. When people pay attention, remember what they learned, and apply it under pressure, the organisation gains something far more valuable than a compliance report. It gains a workforce that knows how to think.

For any CISO staring at the stubborn persistence of phishing incidents, credential compromise, and social engineering attacks, that is not a soft benefit. It is a strategic advantage.