Cybermaniacs Cybermaniacs
Get A Demo
REGIONAL ENTERPRISE

Human Risk In Action

How a Regional Enterprise Moved from In-House Security Content to a Managed Program and Tripled Engagement

1-3
hrm-engage-icon-1
Key Stats

Regional Enterprise

Midsize — 3,500 employees

CaaS — Cybersecurity Content as a Service

 

The Challenge

Why doesn't compliance-based security content change employee behavior?

The security team at a 3,500-employee regional organization had a content problem. Not a shortage of effort — a shortage of impact. Every quarter, the team produced newsletters, awareness emails, and campaign assets in-house. Every quarter, those assets were largely ignored. Open rates were low, interaction was minimal, and there was no way to know whether any of it was changing how employees thought about security.

The harder problem: the team was spending significant time on content that wasn't working — time that wasn't available to spend on anything else. The content looked like security content. It felt like an obligation. Employees had learned to scroll past it, close it, or skip it entirely.

And as the threat landscape shifted — AI-accelerated phishing, social engineering at speed — the organization's content was already two steps behind. Something had to change. Not the effort. The approach.

"We'd built our content on good intentions and not enough time. What we needed was something that worked without us — and that's exactly what we got."

Cyber Awareness Lead, Regional Enterprise

 

The Approach

How do organizations improve engagement with cybersecurity communications?

The organization moved to Cybersecurity Content as a Service (CaaS) — a managed content subscription that delivers a continuous stream of professionally produced cybersecurity communications directly to employees via email and intranet, with no internal production required.

From day one, the security team stopped producing content. CaaS replaced the entire internal content function with a curated, always-fresh program: short-form videos, newsletters, infographics, and awareness assets produced to a creative standard the in-house team couldn't match at volume.

Content was designed from the ground up to earn attention — not to satisfy a compliance requirement. Psychologically informed, visually distinctive, and relevant to real threats employees actually faced. Campaigns were delivered on a consistent cadence, keeping security visible throughout the year rather than spiking around incidents or annual awareness months.

The result was a program that felt different from anything the organization had communicated before: confident, clear, and genuinely interesting to read.

Midsize Use Case

The Results

What changes when a security awareness program creates connection through content?

Within five months, open rates on security content had tripled compared to in-house benchmarks — a material shift that reflected a workforce that had stopped filtering the communications out. Employees began voluntarily sharing content with colleagues. The security team, freed from production, redirected that time toward program strategy and risk management.

Security moved from something the organization communicated at employees to something the workforce engaged with. The qualitative shift was as significant as the metric one: for the first time, the team had a content program they were proud of — and evidence that it was working.

“We'd spent months producing content that disappeared. Within weeks of switching, people were actually asking when the next one was coming.”

Cyber Awareness Lead, Regional Enterprise

Group 126

What Changed & Why It Matters

The shift wasn't just operational — it changed what the security team had capacity to do. Instead of spending time producing content that struggled to earn attention, the team could focus on higher-value work: understanding risk, improving the program, and showing leadership where progress was being made.

At the same time, security stopped appearing only around annual training, incidents, or awareness month. A continuous stream of professionally produced content kept it visible throughout the year — building familiarity, reinforcing key behaviors, and creating the sustained engagement needed to influence how people actually respond to risk.

A note on client confidentiality

Human risk work can reveal sensitive information about an organization, its people and its security program. We protect that information. The stories on this site are drawn from real Cybermaniacs client engagements, with names and identifying details removed or changed. Where several organizations have faced substantially similar challenges, we may combine those experiences into a representative story while preserving the substance of the problem, our approach and the outcomes achieved.

Schedule a Demo

We take time to understand your needs, explore the Cybermaniacs Experience, and align on business goals to strengthen your cyber culture.

Let's Chat