The Challenge

Cyber training is of paramount importance to all local authorities, but ensuring timely completion and genuine engagement with the content can be challenging. Woking Borough Council, like many councils, struggled with motivating staff to not only complete cyber training but also to adopt better security practices. Lengthy one-off cyber training sessions often led to disengagement – something Woking sought to address with a new, more effective solution.

Our previous training package saw staff being given access to all modules at once, and subsequently they would often be completed in one sitting – potentially being regarded by staff as a chore, and not being afforded the importance that this critical training requires. An internal audit in July 2022 highlighted this problem, revealing that 223 out of 444 users had not completed any of the assigned cyber training.

Added to this, managing the cyber training and the relevant tasks associated with rollout to numerous teams in different locations was a time intensive process for Woking. Our staff, already juggling multiple priorities, often lacked the time and resources to properly oversee the training process. 

Cyber security and training take up was recognised to be a priority and Woking wanted a more flexible solution, which covered new and emerging threats and a system that allowed us to monitor staff completion and success.

The Solution

Following a review of a range of cyber training packages, Woking Borough Council procured the Fundamentals solution from CC2i, an accessible video driven format with in-built user testing – we then collaborated to tailor the training to our cyber needs. Together, we developed a rollout plan with CC2i that utilised the platform’s built-in module release schedule to ensure a gradual and effective training deployment.

The agreed schedule involved releasing 12 modules over a 10-month period, giving staff until the next module’s release to complete the previous one. To ensure this process ran smoothly and effectively, we made full use of the platform’s automated emails, including activation and tutorial emails. Each month, a tutorial notification email was sent to all staff when a new module became available, keeping them on track with deadlines and encouraging timely completion.

Accompanying the new tutorial emails were activation and tutorial reminders – activation emails were sent on a weekly basis to those who hadn’t yet activated their accounts, automating the process of reminding users to create an account and complete the modules. Tutorial reminder emails were also sent on a two-week basis to those who hadn’t yet completed the modules assigned to them, offering gentle encouragement to stay on course.

To boost engagement and completion rates, each Fundamentals module was bitesize in its approach, lasting 5-10 minutes on average. The module duration was an important factor for Woking, as it established the more realistic expectation of users having 5-10 minutes to spare in their day to complete one tutorial, whilst avoiding information overload.

Another feature to help encourage high completion rates was the strategic placement of the Q&A in the modules. Replacing the usual approach of all Q&A appearing at the end, the questions instead appeared at various intervals throughout the module, requiring our staff to stay attentive to the content to answer questions correctly and proceed, reinforcing good learning outcomes.

The service was fully managed and hosted by CC2i, which included a weekly update of the staff list, (requested by us) to ensure that new starters were quickly set up and those who had left were removed. This consistent database maintenance by CC2i kept the system up-to-date and ready for seamless training delivery.

The Impact

The monthly release of the modules, coupled with the automated tutorial emails and reminders has seen a consistently high module completion rate every month, with users achieving an average score of 82% across all applicable modules.

There has been an almost 95% take-up rate compared to our previous training programme which was just under 50%, and an increase in reports to our service desk regarding receipt of potentially insecure emails, highlighting not only the increased vigilance of staff, but also the ease of completing a module a month without it being an undue burden.

The introduction of CC2i Fundamentals has had a significant impact on Woking’s simulated phishing campaigns as well. Before the training, 23% of staff engaged with simulated phishing emails, indicating a clear vulnerability. Following the training, this engagement rate dropped dramatically to just 3.5%, showing a substantial improvement in user awareness and vigilance.

Additionally, the Human Risk score, which measures our susceptibility to cyber threats, decreased from 5 (over 20% engagement) to 3 (over 10%). This reduction highlights a significantly positive shift in cyber culture, with employees becoming more discerning and cautious. The sustained low engagement with simulated material indicates that the Fundamentals training is having a lasting impact, reducing vulnerability, and creating safer habits.

The managed service by CC2i has also freed up time for Woking staff to focus on other high priority tasks, whilst also being able to periodically check in and review the uptake of the training, via the system itself and through the designated account manager.

“In the space of a year, we have gone from approximately 50% of our user base never undertaking essential cyber security and information governance awareness training, to reaching almost our entire staff team on a monthly basis. We’re now providing them with the knowledge and skills they require to work securely and to adhere to GDPR principles.” – Head of Digital Services 

How is this approach being sustained?

Regular meetings between CC2i and Woking ensures that the training remains aligned with our needs. Woking also have the opportunity to update the module release schedule at a time of our choosing (in this case on a yearly basis) and change the modules on an annual basis, allowing for meaningful year-to-year comparison of training metrics.

Expanding on metrics, we also have full access to all staff data which we can download at any time, providing us with the convenience and ability to regularly review the training uptake and completion rates.

Lessons learned/Main takeaways

Woking can very clearly see that delivering all cyber training modules at once was not an effective approach in respect of the take-up and completion of the previous training suite, something which needed to be addressed swiftly. By taking small but significant steps in rolling out the modules on a monthly basis, we have found a highly successful and sustainable way of learning, which is easy to manage and easy to implement.

This monthly approach also enables us to evaluate the impact of each module individually, helping to identify the strengths and weaknesses of different cyber security topics. This level of detail allows us to pinpoint areas needing additional training or guidance, fostering lasting improvement in cyber security awareness.

Contact

If you’d like to find out more about this case study, please contact lottie.horwood@cc2i.org.uk