A Holistic Evaluation Model for Information Security Awareness Programs in Work Environment

Cybersecurity Awareness (CSA) programs play an crucial role in avoiding the human errors that lead to cyberattacks. Traditional CSA programs depends on self-reporting methods to assess the employees knowledge and behavior. However, relying on self-reporting methods may yield in inaccurate measurements and pose challenges in monitoring the change and improvement in employees behavior and compliance. In this paper, we propose a novel framework to assess the employees' behavior, by passive and active techniques that collect data from different sources. Our proposed method supports Machine Learning (ML) for data analysis to identify security risky behavior and recommend the most effective program to each group of employees based on their needs.