Increasingly sophisticated cyber attacks are making it harder for employers to ensure their workforce recognises threats and follows cybersecurity procedures.
These risks were put into focus when online fashion retailer Asos revealed last week (Tuesday 6 October) that an attacker had gained access to an employee’s login credentials by impersonating a trusted contact.
In an official statement, the retailer said it immediately locked down the affected platforms after the discovery.
Employee data breaches hit seven-year high, study finds
M&S, Co-op and Harrods hit by cyber attacks – what is HR’s role in the fight against online crime?
HR expertise needed: why it’s no longer just IT’s role to protect firms from cyber attacks
Highlighting how such attacks can exploit employees’ trust in familiar contacts, Bruce McDougall, governance director and principal cyber and information security adviser at Black Arrow Cyber Consulting, says: “Employees are on the frontline, interacting with attackers who are impersonating trustworthy third parties by email, Teams or phone.”
He adds that attackers are exploiting “normal working relationships” through increasingly convincing requests making it difficult for employees to recognise potential threats.
Meanwhile, Anastasia Voronkova, insights analyst at Mindtools Kineo, warns that knowing about cybersecurity risk does not always mean employees take the right precautions, adding that “knowledge alone doesn’t change behaviour”.
With the government’s Cyber security breaches survey 2025/26 finding that 38 per cent of UK businesses experienced phishing attacks in the previous 12 months, how can HR help employees identify threats and comply with cybersecurity policies?
Helping employees recognise cyber threats
To improve compliance with cybersecurity policies, Voronkova advises HR to tailor training to employees’ roles, focusing on the risks they are most likely to face and how to respond.
She warns that traditional methods of identifying suspicious communications are becoming less reliable, as attackers are developing more sophisticated techniques.
“Old advice such as checking for poor grammar no longer works reliably, thanks to AI-generated threats,” she explains, adding that employees should be alert to unusual requests, such as unexpected links or demands for login credentials.
Jack Moore, global cybersecurity adviser at ESET, says cybersecurity should be embedded in everyday working practices rather than treated as an annual training exercise.
“Policies need to be simple and easy to follow. People will naturally always try to bypass difficult or inconvenient policies,” he adds.
Moore also recommends regular simulations and practical training, advising employees to “verify unexpected requests by using multiple platforms to confirm who they are dealing with”.
However, McDougall says HR should work with line managers to reinforce cybersecurity policies and measure whether training improves behaviour, rather than relying on course completion rates.
He adds that phishing simulations should be used to build employees’ confidence in recognising and reporting suspicious activity, rather than penalising mistakes.
“Phishing simulations should be an opportunity to practise identifying and reporting suspicious emails; they should not be a bruising ‘gotcha’ where the punishment is more training,” McDougall explains.
Balancing accountability with a supportive culture
Alongside training, Moore says employees must feel able to report cybersecurity mistakes promptly, rather than hiding them, warning that “fear can make people worry unnecessarily and it can often make things worse if kept quiet”.
He advises HR to differentiate between genuine mistakes and deliberate misconduct, prioritising education and prevention rather than automatically resorting to disciplinary action.
Similarly, Voronkova says employers should look beyond individual mistakes when responding to cybersecurity incidents, noting that “most breaches come from human error, not malice”.
She warns that disciplinary measures may be ineffective if employees do not already see secure behaviour as the norm. “Without that culture, penalties lose their effect and can drive mistakes underground,” she says.
Employers should therefore consider whether factors such as workload, confusing processes or unclear guidance contributed to an incident, Voronkova adds, and address these to prevent similar mistakes.
However, McDougall says businesses must also hold staff accountable for unsafe behaviour, particularly when senior employees disregard cybersecurity procedures.
“Take action if senior team members openly disregard or bad mouth security because it is seen as inconvenient,” he advises.
For further guidance, listen to the CIPD’s podcast on managing cybersecurity risks through employees
