News Wings

Tag: KnowBe4 Africa Human Risk Management Report 2025

  • Beware the Bring Your Own Device (BYOD) blind spot: Personal devices are a complicated weak link

    Beware the Bring Your Own Device (BYOD) blind spot: Personal devices are a complicated weak link

    …Some useful technical controls include employees having strong passwords, multifactor authentication (MFA), encryption, endpoint security and patching

    Up to 84% of organisations globally practise bring your own device (BYOD) in some form, but only half of them officially allow it, according to a recent report. While the convenience and cost saving of employees’ using their own personal devices for work is undeniable, there are many security risks involved too, particularly in hybrid and remote work environments, asserts Anna Collard from KnowBe4 Africa.

    It’s becoming increasingly common for organisations to expect employees to use their own personal devices for work, such as smartphones, tablets and laptops, and employees seem to prefer the level of freedom it gives them. From an organisational perspective, they stand to save an average of R5 000 per employee every year if their employees use just their own mobile devices, with two-thirds reporting that it boosts their productivity.

    In South Africa, this trend has also become ubiquitous. “BYOD, particularly with smartphones having access to corporate email accounts, has become the norm for a lot of South African organisations for many years already,” asserts Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 Africa.

    “While organisations in the financial services sector will have stricter policies, many start-ups, SMEs and even some larger organisations often allow, or even expect, employees to use their own phones and laptops, sometimes without formal policies in place.”

    While flexible and convenient, she believes this informal approach introduces significant cyber and compliance risks. The new KnowBe4 Africa Human Risk Management Report 2025 highlights that up to 80% of employees in Africa use personal devices for work, with broader studies finding 70% of these devices are unmanaged – a critical blind spot for many organisations.

    BYOD blind spots

    The most notable cybersecurity risk associated with BYOD is data leakage. “Personal devices can easily leak sensitive data through unsecured apps, cloud storage or public Wi-Fi,” she explains. “Without proper controls, even a misplaced phone can become a breach vector .”

    Another security blind spot is employees downloading malicious apps. “Employees may unknowingly install apps that contain malware,” Collard comments. “Some apps mimic legitimate ones, but secretly harvest data or open backdoors into corporate systems.” This also extends to “shadow IT” – the use of unapproved applications or services – which can proliferate via personal devices, creating unmonitored entry points for attackers.

    A further risk is outdated software. “Personal devices may run outdated operating systems or apps, making them vulnerable to known exploits,” she says. “IT teams often lack visibility to patch non-managed devices, and a large percentage of people have ‘an update is ready to be installed on your device’-notifications that have been hanging around for ages; unactioned.”

    In addition, many employees may have a false sense of security about their phone or laptop, especially since almost half of Gen Z respondents (48%) take cybersecurity protection on their personal devices more seriously than on their work devices, according to an Ernst & Young survey in the US. “Just because it’s my device doesn’t mean it’s secure for sensitive work data,” stresses Collard. “A weak BYOD policy opens the door to data leaks, shadow IT and insider risk.”

    What organisations should do

    In order to mitigate these risks, organisations need to come up with a robust BYOD policy. “It starts with policy and awareness,” she states. “Organisations must have a clear, communicated BYOD policy – what’s allowed, what’s not and what minimum protection is expected.”

    Some useful technical controls include employees having strong passwords, multifactor authentication (MFA), encryption, endpoint security and patching. Organisations can also segment their networks to isolate personal devices from critical corporate assets. “Mobile Device Management (MDM) tools can enforce some controls,” concedes Collard, “but they can’t replace human vigilance.”

    She is a firm advocate of security awareness training to heighten awareness of cybersecurity risks, especially among younger employees who are more likely to use the same passwords for their personal and professional accounts. “Organisations need to educate employees on the specific risks of BYOD, beyond  ‘don’t click links’,” she says. This is crucial, as 96% of organisations believe their employees might fall for more attacks in the future due to AI use by bad actors. The KnowBe4 Africa Human Risk Management Report 2025 further highlights that AI policy remains a governance blind spot in many organisations, with 46% still developing formal AI policies – making employee education on AI-related BYOD risks even more critical.

    “Organisations can simulate attacks that leverage BYOD vulnerabilities, such as phishing specific to mobile apps, while fostering a culture where employees feel comfortable reporting potential incidents on personal devices without fear of reprisal.”

    Alongside security training, Collard is an advocate of digital mindfulness, which she describes as an important  weapon against cybersecurity threats. “Being digitally mindful helps employees slow down, become aware of risky moments and question suspicious behaviour, especially on personal devices,” she says.

    Managing the human element

    Even though privately-owned devices may appear to be the problem, managing the human element is absolutely key in mitigating BYOD security risks. “A device is just a tool; what matters is how we use it,” Collard emphasises. “You can have the most secure set-up, but if someone is rushed, tired or emotionally triggered, they’re more likely to click on a malicious link or fall for a scam.”

    She is adamant that organisations need to train their employees’ attention and awareness to build resilience, not just rely on tools. “Ultimately, it’s a combination of the right technology and human vigilance,” she concludes.  

  • Cybersecurity, gamified: Can fun actually build better habits and protect users?

    Cybersecurity, gamified: Can fun actually build better habits and protect users?

    …Applying game-design elements, such as points, badges, leaderboards and rewards, to cybersecurity training taps into our natural desire for achievement, competition and progress

    Traditional cybersecurity and compliance training can be dull as dishwater, which can lead to poor engagement and low retention among employees. Gamification, if done well, offers a refreshing alternative, transforming boring modules into interactive experiences that foster real behavioural change and strengthen your organisation’s overall security posture, argues KnowBe4 Africa’s Anna Collard

    “Traditional training often feels like a drag, too theoretical, irrelevant or disconnected from daily work where people already feel overwhelmed and overloaded,” asserts Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 Africa. She says presenting one-size-fits-all content to employees that has little real-world application often fails to engage their attention or change their behaviour. “People forget information they don’t emotionally engage with or see relevance in,” she comments. “Worse still, it does little to instil a true security mindset, the kind that turns passive participants into proactive defenders.”

    Enter gamification

    By contrast, applying game-design elements, such as points, badges, leaderboards and rewards, to cybersecurity training taps into our natural desire for achievement, competition and progress. “When learning feels like an exciting challenge rather than a chore, retention and engagement improves,” Collard explains. “It helps shift cybersecurity from a compliance burden to a personal skill to be proud of”.

    Collard explains that there are sound behavioural and cognitive psychological principles that make gamification so effective. “When we achieve a goal, the brain releases dopamine, activating its reward centres,” she says. “That’s what makes gamified learning so engaging – it literally feels good to make progress.”

    Similarly, setting goals has multiple benefits. “When you introduce clear, incremental goals, it increases motivation,” Collard maintains. Social comparison is another psychological phenomenon which can be leveraged. “Leaderboards and peer benchmarking appeal to our natural tendency for social comparison,” she states. “When employees see how they stack up, they often push themselves further.”

    However, Collard believes the ultimate form of motivation is not rewards. “The best gamified security programmes go beyond badges and points,” she says. “They tap into intrinsic motivators like autonomy, mastery and purpose, which drive lasting behavioural change.”

    From fitness to language apps

    Other industries have successfully harnessed the power of gamification – from fitness reward programmes to educational apps. “By giving away free smoothies and coffees, Virgin Active and Discovery Vitality are actually encouraging their members to stay fit and healthy,” comments Collard. “Likewise, language apps like Duolingo help learners keep track of their progress through streaks, leaderboards and daily goals.” It’s examples like these that have inspired cybersecurity training firms to follow suit.

    “One of our most popular security games is Spot the Phish which we developed with Sanlam many years ago,” she explains. “It’s easy and fun to play, while teaching users what to look out for.” By swiping left or right, players are introduced to multiple phishing scenarios where they could be scammed. “I think its simplicity is what made it so successful.” Another effective game she uses is a story-driven simulation where employees assume roles, such as a cybercriminal or a detective, and make choices that lead to different outcomes. “This kind of narrative immersion helps them grasp the real-world consequences of their actions,” Collard explains.

    Turning passive employees into proactive defenders

    But how do organisations move from compliance fatigue to security enthusiasm? Collard suggests starting small, such as a leaderboard for fastest reporting of simulated phishing emails or incorporating storytelling in games. Another recommendation is for organisations to track engagement among employees. “This identifies knowledge gaps and content can then be adapted accordingly,” she says. This is crucial, as the KnowBe4 Africa Human Risk Management Report 2025 revealed that over 41% of responding organisations say their biggest challenge is measuring whether security awareness training (SAT) actually works. This “confidence gap” highlights a disconnect between perceived awareness and actual readiness, meaning a workforce appearing trained on paper might be vulnerable in reality.

    The report further highlights that traditional training frequency is often insufficient, with 29% of organisations conducting training annually and 39% biannually. This low frequency contributes to the “prevalence effect,” where infrequent exposure to even simulated threats makes employees less likely to detect real attacks. To counter this, gamified phishing simulations, when conducted more frequently, have been shown to directly correlate with measurable improvements in security behaviour. KnowBe4’s research from over 60 000 individual organisations worldwide, comprising over 32 million individual users, confirms this – increased simulation frequency leads to better security habits.

    Lastly, by involving employees and rewarding their progress, meaningful behavioural change can occur. “Let your employees come up with their own team names because ownership increases participation,” she urges. “In terms of rewards, offer them incentives or recognition for their achievements.” Incorporating these principles into your organisation’s cybersecurity training will not only up the fun levels at work, it will also have lasting benefits.

    “The right application of gamification will increase participation and improve knowledge retention among your employees, resulting in a stronger security posture and a more positive security culture,” Collard concludes. This is especially important given that the KnowBe4 Africa Human Risk Management Report 2025 also found that only 10% of decision-makers are fully confident their teams would report a suspicious email or threat. Gamification offers a tangible solution to bridge this gap, translating awareness into actionable, consistent security behaviours.

  • Digital gossip: When WhatsApp groups become serious cyber-risk zones

    Digital gossip: When WhatsApp groups become serious cyber-risk zones

    …Official communications ending up on personal devices and informal platforms is a problem very clearly not exclusive to the corporate sector

    Despite their popularity among employees, informal messaging platforms pose significant risks to organisations’ cybersecurity. The 2025 KnowBe4 Africa Annual Cybersecurity survey found that 93% of African respondents use WhatsApp for work communications, surpassing email and Microsoft Teams. What can organisations do to protect themselves from data leakage and other threats? 

    For many organisations, platforms like WhatsApp and Telegram have become integral to workplace communication. Ease of use is what makes them so popular, explains Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 Africa. “Particularly on the continent, many people prefer WhatsApp because it’s fast, familiar and frictionless,” she asserts. “These apps are already on our phones and embedded in our daily routines.” 

    In terms of collaboration, these platforms also help employees to work together, especially in remote or hybrid work environments. “It feels natural to ping a colleague on WhatsApp, especially if you’re trying to get a quick answer,” she says. “But convenience often comes at the cost of control and compliance.” 

    Informal messaging, formal risks 

    Recent cases have underscored the risks of using informal platforms for professional communication. Increasingly, WhatsApp messages are being used as evidence in employee tribunals and other legal cases. The British bank, NatWest has gone so far as to ban WhatsApp messages among its staff. In the US, a top-secret military attack on Yemen was leaked on the messaging platform Signal earlier this year, with the plan inadvertently shared with a newspaper editor and other civilians, including the Defence Secretary’s wife and brother.  

    Official communications ending up on personal devices and informal platforms is a problem very clearly not exclusive to the corporate sector. 

    “There are multiple layers of risk,” states Collard. “It’s important to remember that WhatsApp wasn’t built for internal corporate use, but as a consumer tool. Because of that, it doesn’t have the same business-level and privacy controls embedded in it that an enterprise communication tool, such as Microsoft Teams or Slack, would have.” 

    The biggest risk for organisations is data leakage. “Accidental or intentional sharing of confidential information, such as client details, financial figures, internal strategies or login credentials, on informal groups can have disastrous consequences,” she says. “It’s also completely beyond the organisation’s control, creating a shadow IT problem.” This is a growing concern, as the 2025 KnowBe4 Africa Annual Cybersecurity survey noted that up to 80% of respondents use personal devices for work, many of which are unmanaged, creating significant blind spots for organisations. 

    Another major risk is the lack of auditability. “Informal platforms lack the audit trails necessary for compliance with regulations, particularly in industries like finance with strict data-handling requirements,” explains Collard. 

    Phishing and identity theft are also threats. “Attackers love platforms where identity verification is weak,” she says, adding that at least 10 people in her personal network have reported being victims of WhatsApp impersonation and takeover scams. “Once the scammer gains access to the account, in many cases via SIM swaps, the real user is locked out and they have access to all their previous communications, contacts and files,” she comments. “They then impersonate the victim to deceive their contacts, often asking for money or even more personal information.” 

    Beyond security, using these channels can also lead to inappropriate communication among employees or the blurring of work-life boundaries, resulting in burnout. “Having a constant stream of messages can also be distracting and lower productivity,” says Collard. 

    Having the right guardrails in place 

    For organisations wanting to mitigate these risks, it’s important to set up a clear communications strategy, Collard maintains. “First, provide secure alternatives,” she says. “Don’t just tell people what not to use. Ensure that tools like Teams or Slack are easily accessible and clearly endorsed.” 

    The next step is to educate employees on why secure communication matters. “This training should include digital mindfulness principles, such as to pause before sending, think about what you’re sharing and with whom, and be alert to emotional triggers like urgency or fear, as these are common tactics in social engineering attacks,” shares Collard. “By promoting psychological safety, employees feel comfortable questioning odd requests, even if they appear to come from a boss or client.”  

    This is particularly vital given the “confidence gap” highlighted in the new KnowBe4 Africa Human Risk Management Report 2025, where high perceived awareness of cybersecurity policies often doesn’t translate into employees feeling fully confident or supported in reporting incidents or questioning suspicious communications. 

    By introducing approved communication tools, organisations can benefit from additional security features, such as audit logs, data protection, access control and integration with other business tools. “These platforms also support more mindful communication norms, like scheduling messages or setting availability statuses,” says Collard. “Using approved platforms helps maintain healthy boundaries, so work doesn’t creep into every corner of your personal life. It’s about digital wellbeing as much as it is about cybersecurity.” 

    In conclusion, Collard maintains that while informal messaging offers convenience, its unchecked use introduces significant cyber risks. “Organisations must move beyond simply acknowledging the problem and proactively implement clear policies, provide secure alternatives, and empower employees with the digital mindfulness needed to navigate these cyber-risk zones safely,” she emphasises.