How to Tell Your Co-Workers That They Suck at InfoSec and Actually Get Away with It

Explore a practical case study on implementing information security awareness in organizations through this 44-minute conference talk from MRMCD2025. Learn how to effectively communicate the importance of information security to employees without creating resistance or resentment. Discover strategies for transforming the common perception of security measures from burdensome restrictions to necessary business practices through a real-world workshop example involving over 300 employees. Examine the preparation process, workshop execution, unexpected challenges, colleague reactions, and subsequent organizational decisions. Gain insights into common employee concerns such as "What's the point?" and "How am I supposed to work like this?" and understand how to address these objections constructively. Analyze what worked well in the presented approach, identify areas for improvement, and understand essential elements for successful security awareness initiatives. Benefit from lessons learned about balancing employee needs with organizational security requirements, making this talk valuable for IT leaders, security professionals, and anyone responsible for implementing security policies in workplace environments.