How leading bicycle manufacturer, Accell Group made security training a ride in the park

Sudden steep elevation in the threat landscape

In the two years leading up to 2017, Fabian De Wit, Senior Security Officer of Accell Group, grew increasingly worried about how quickly phishing attacks were evolving. He’d long understood email-originated breaches were the biggest security risk for companies, and he wanted to level-up awareness at Accell group to match the growing threat. The first solution his security team tried was an expensive, one-off consultancy program. It included a physical penetration test, a social engineering phone, or “vishing” attack and a phishing simulation campaign. The failure rate came back at 58%. This set off some alarm bells.

“It was a wakeup call for all of us, including management,” said Fabian. “I was pointed towards Hoxhunt, and I saw that it was exactly what I needed: it was automated, and it used artificial intelligence to get real phishing emails into the phishing training. It was the right tool at the right time.”

Positive philosophy

Accell Group wanted to change employee email behavior and elevate security culture. The ideal training solution would invite voluntary participation by providing a positive experience along with plenty of practice recognizing and reporting phishing attacks.  Cybersecurity didn’t need to be as awful an experience in training as it was a frightening danger in real life.

“The product matches my life philosophy, which is that people learn best from stimulating, positive behavior,” said Fabian. “Yes people learn from their mistakes, but they don’t really learn just from being told how many things they’ve done wrong and being punished for a high fail rate.”

Rewarding good behavior is in Hoxhunt’s product DNA. Traditional security programs focus on failure-based contextural training; the user only receives training after falling for a simulated phishing link. It’s pure negative reinforcement. Hoxhunt, however, congratulates employees for reporting phishing emails, and provides a supportive micro-training experience after a failure.

“I’m really fond of the positive attitude and experience that hoxhunt gives you when you click on a phishing simulation. It’s not like the screen goes flashing red with alarms going off and a scary text that says, YOUR FAULT, ERROR, YOUR CONTRACT IS TERMINATED! Instead it gives you a quick lesson in a nice and positive way and moves on.”

Fabian also found that the automated and personalized nature of Hoxhunt was a distinct advantage. Being able to send more high-quality phishing simulations with less effort and fewer resources was the differentiating factor.

“Hoxhunt is low-maintenance. Maintaining other platforms was cumbersome for a small security team because of all the customization required, from setting up the different phishing-email campaigns to keeping track of the results. Hoxhunt does the heavy lifting for you.”

Good leadership, good culture

Fabian took a strong lead in making sure the Hoxhunt security training program got on track.

“You need someone in the company who is really focused on making awareness with Hoxhunt a success. You need to have an advocate. You cannot buy Hoxhunt and import your employee list and click on the button and go. You have to really go up and sell it.”

First, he made sure the key stakeholders were on board:

• Leadership: In the first stage of implementation, Fabian had a seat on the board to discuss security posture and awareness performance progress. He monitors the metrics that are reported to the board. There is  critical support from the CFO, who champions security as a fundamentally important aspect of enterprise risk management and corporate culture.
• Management: He secured managers’ buy-in to customize phishing simulation emails sent to their employees using their names to better simulate spearphishing and BEC attacks, the largest vector of cybercrime in the world by far.
• IT: He explained the importance of participating in the program with his security team and IT colleagues.
• Employees: He made sure through company communications channels, and through their managers, that employees understood they would not be singled out or punished for failure. He actively engages employees through multiple channels, including the company newsletter every two months, which contains a blurb about broad security topics and Hoxhunt performance metrics alongside business activities.
• “I am very happy with how our company has improved its attitude towards security. Today, it is a top priority. In IT, we are always doing multiple projects, but if IT managers need to prioritize, and there is a security initiative, that moves up top. That is a cultural change in how management is prioritizing projects. If it is security, then we need to take it seriously.”

Managing with the metrics that matter

Fabian is an innovative security thinker. He understands how to focus on the metrics that matter: participation rates, real reported threat rates, and phishing simulation failure rates. He communicates progress on those metrics across the organization.

He is particularly proud of his company’s high participation rate of around 70%, when the program was completely voluntary. The more people engage, the less they fail and the more they succeed in phishing simulation reporting. In other words, practice makes perfect in terms of lowering risk. Given the importance of the program, Hoxhunt training is mandatory for every employee with an email-address.

Are they perfect yet? No. But as a world-class bicycle company understands, it’s important to embrace the journey.

“There’s a road to travel but we are half way up the mountain. We can look up and see a way to go but we can also look back and see how far we’ve come.”

‍