What the Odido Hack Teaches Us About Awareness That Works

If you look at the major incidents of recent times—Odido, Chipsoft, the municipality of Epe—one thing stands out. In each case, a hacker exploits a person within the organization, not a technical vulnerability. That doesn’t mean technology isn’t important—quite the contrary. But technology alone won’t save you. As soon as you secure one layer, the attack shifts to the next. People, organization, and technology together form the trinity that determines your security, and if you weaken any one of the three, that’s exactly where the attack will enter your organization.

There’s a persistent misconception that security awareness is the same thing as a phishing test. If you look back at the root cause of many incidents, phishing often turns out to be only a small part of it. At Odido and Chipsoft, attackers gained access through social engineering—via a phone call in which someone impersonated another person. Physical access also plays a role: someone posing as a technician who simply walks right in without anyone asking any questions. If you really want to make your employees resilient, you need to look far beyond just an email with a suspicious link.

The difference between a program that works and one that exists only on paper lies in intrinsic motivation. Employees have to want to do it themselves, and that only happens when the content is engaging and relatable. Storytelling plays a key role in this: an employee who recognizes a real-life case from the radio, television, or the newspaper will remember that information much better than a dry question or a dilemma on a screen. It’s all about an emotional connection. Only when someone thinks, “Wait, I’ve seen this before,” does the top-of-mind effect kick in—the very effect needed to respond differently to a suspicious phone call in real life.

A question that comes up often: Do you offer awareness training on a mandatory or voluntary basis? Both extremes are counterproductive. Offering it on a completely voluntary basis results in a participation rate of no more than twenty percent, while the word “mandatory” gives a negative connotation to something that should actually feel positive. The happy medium lies in the message: an organization that makes it clear that it considers this important for the protection of customer and employee data, and in which managers also communicate this as their own responsibility. Communicating the “why” is at least as important as the program itself.

Security awareness also has its own three-part framework. First, the quality of the platform: does it take the burden off your organization, with automated learning paths and reminders, without requiring you to invest a lot of time yourself? Second, the content: is it up-to-date, relevant to your local context, and does it resonate with the target audience? Third—and this is the part a vendor can never fully handle for you—how you roll out the program within your own organization. Does senior management provide support, do department heads follow up with teams that are falling behind, and is the program discussed systematically during staff meetings? It is precisely this rollout that ultimately determines whether behavior actually aligns with policy.

A one-size-fits-all program rarely works well for the entire organization. IT professionals value in-depth content that aligns with their field and actually find simplistic modules tedious. Production workers, on the other hand, don’t sit at an office computer, but they do operate systems, and are often better reached through an in-person session than through an online module. Different sectors also require their own approach: in a hospital, unauthorized access to electronic health records is a concern, while the government and education sectors face different risks. The more specifically the program is tailored to a role and sector, the more effectively it will be retained.

One piece of advice keeps coming up: make sure you stay up to date and maintain constant awareness. Organizing an awareness campaign once a year or once every few years is no longer enough in today’s threat landscape. The world is changing too quickly, and incidents like Odido show that employees will only respond alertly if the threat has been communicated to them in a way that is recent and recognizable. Aligning behavior with policy is therefore not a one-time effort, but an ongoing process of staying current, repeating key messages, and fostering engagement across the entire organization.