Here are 5 bullet points summarizing this post:

• The "start, stop, and continue" framework can be used to improve an organization's security awareness training and human risk management.
• Starting can involve introducing new initiatives or practices to improve the security posture, such as conducting a comprehensive risk assessment, implementing a security engagement program, and testing the incident response plan.
• Stopping can involve eliminating practices that are hindering progress, such as relying solely on technology, neglecting security awareness training, and ignoring feedback from employees and customers.
• Continuing can involve maintaining practices that are working well, such as regularly assessing the security posture, prioritizing security awareness training, and encouraging a culture of security.
• By applying the "start, stop, and continue" concept to infosec programs, organizations can identify areas for improvement and maintain effective strategies for protecting against cyber threats.

If you're looking to improve your organization's security awareness training and human risk management, the "start, stop, and continue" concept can be a useful framework to guide your efforts. This approach involves identifying what you should start doing, what you should stop doing, and what you should continue doing to achieve your goals.

Start: What Should You Begin Doing?

When it comes to infosec programs, starting can mean introducing new initiatives or practices to improve your security posture. Here are some suggestions for what you could start doing:

1. Take human risk assessment seriously: To effectively manage human risk, you should start by understanding where the risks lie. Conducting a comprehensive risk assessment can help you identify vulnerabilities and threats, and prioritize the areas that need the most attention.
2. Implementing security engagement: Security awareness training checks a box while security engagement building security mindset and culture. Starting an engagement program can help you build a strong culture of security within your organization. This new program can augment the existing training you do by adding drip security content like Haekka does with scams of the week in Slack.
3. Testing your security incident response plan: Like really testing it. Being prepared for security incidents is crucial for minimizing their impact. Starting the development of an incident response plan can help you respond quickly and effectively to any security incidents that may occur. More regulations and strict requirements are coming for incident detection and reporting.

Stop: What Should You Stop Doing?

Stopping can mean eliminating practices or behaviors that are hindering your progress. Here are some suggestions for what you could stop doing:

1. Relying solely on technology: While technology is an important tool in your security arsenal, relying solely on it can lead to a false sense of security. Stop relying on technology to do all the work and start focusing on building a culture of security.
2. Neglecting security awareness training: If you're not currently providing security awareness training, stop neglecting it. Employees are often the weakest link in the security chain, so training them to be vigilant and security-conscious is crucial.
3. Ignoring feedback: Feedback is essential for improving your security posture. Stop ignoring feedback from employees, customers, and other stakeholders and start using it to improve your programs. This is especially true with most security awareness training, which has low employee engagement and NPS. With Haekka, you can continuously get feedback directly from users in Slack.

Continue: What Should You Keep Doing?

Continuing can mean maintaining practices or behaviors that are working well. Here are some suggestions for what you could continue doing:

1. Regularly assessing your security posture: Continuously assessing your security posture is crucial for staying ahead of threats and vulnerabilities. Keep conducting regular risk assessments to stay on top of potential risks.
2. Prioritizing security awareness training: Security awareness training should be an ongoing process. Continue prioritizing it and making it a regular part of your employees' training and development.
3. Encouraging a culture of security: Building a culture of security takes time, but it's essential for maintaining a strong security posture. Continue encouraging employees to be vigilant and security-conscious, and recognize and reward good security practices.

——

By applying the "start, stop, and continue" concept to your infosec programs, you can identify areas that need improvement, eliminate practices that are hindering progress, and maintain effective strategies. With a focus on security awareness training and human risk management, you can build a strong culture of security that will help protect your organization from cyber threats.

‍