Prioritizing cybersecurity investments based on real risk, while using data and risk indicators to reduce vulnerabilities and allocate resources more strategically, is essential to building organizational resilience.

Identifying users who are most susceptible to cyberattacks should not be based solely on their level of information security knowledge, as many different factors influence their level of risk.

Through leadership, employees have an example to follow and understand that secure behavior is also their responsibility.