CSE2HUM Board Paper Executive Proposal Cybersecurity Culture & Awareness Plan

Executive Summary

AI Med Innovations is a rapidly growing company in the medical technology field, but its growth has made the company vulnerable to various cybersecurity issues. The main flaws reside in staff behaviour, which are observed in the audit highlighting cultural vulnerabilities, reuse of passwords, the use of unprotected personal equipment, insecure coding, and the lack of understanding where to report incidents. These actions undermine compliance with regulation, damaging client and investors trust. To address these concerns, here is a proposal of 12-month program of Cybersecurity Culture, Awareness and Engagement Uplift. The program establishes a roadmap concerning the need to make cybersecurity a responsibility at every level of the company. It involves job-related training, management participation, awareness programs through games, and timely reporting. The initiative will focus on risky behaviours reduction and building resilience with measurable objectives and milestones to revise the role of cybersecurity as a driver of trust, innovation, long-term reputation, rather than slowing productivity.

Background

AI Med Innovations is a 20-employee med-tech start-up established in Melbourne, 2022, creating affordable digital health solutions for small clinics and medical professionals. Additionally, it provides patient management system, Telehealth technologies and other services.  It ensures agility and affordability, contributing to the fastest client acquisition but due to rapid innovation security practices have not kept up.

With recent cultural evaluation there were some alarming findings, as 65% of employees reported using the same password, fifty percent of the employees share same credentials, and 70% employees use personal devices without employing suitable security measures. Half of them have recently clicked on suspicious links, and 80 % of employees have never undergone formal cybersecurity training. Often the intern and contract workers are brought on-board without proper scrutiny and guideline, undermining accountability further. Even though the leadership recognise the significance of cybersecurity at its core but operational practices prove otherwise due to prioritisation of speed and delivery over security (AI Med Innovation, 2025).

AI Med Innovations has an obligation to keep patients’ data confidential and secure in compliance with privacy policy in healthcare sector. Even minor violation would lead to extreme financial losses, reputational harm and loss of trust with customers and shareholders, necessitating cultural change to incorporate cybersecurity into the organisational DNA.

Recommendation

The Board should adopt 12-month Cybersecurity Culture, Awareness and Engagement Uplift Program that incorporates cultural, educational, and behavioural interventions. This program will provide hotspot education, awareness and engagement methods that caters the requirements of Board, Leadership, development team and support staff. It will be ensured through role-based training, such that developers strengthen coding practices, finance department employees receive training on effective fraud management and sales department employees will learn how to operate safely, processing client’s data with interns and contractors receiving proper onboarding.

The program will also incorporate quarterly phishing simulations and awareness campaigns, formal reporting, and regular cybersecurity briefings to the Board. This will facilitate in monitoring and improving staff readiness establishing governance structures promoting accountability. With briefings there will be oversight from the board aligning decisions with best practices.

The progress will be measured using the specified key performance indicators such as the percentage of training completion, the reduced number of phishing clicks, and improvements in cybersecurity culture surveys. Amalgamation of these measures will transform cybersecurity as more of an organisational responsibility, and as a driver of growth, compliance, and trust.

Key Challenges Identified

The company has been facing several major cybersecurity challenges within its culture;

1. Low awareness- The recent phishing test highlighted the 65% of the staff failing in identification of basic issues, whereas 80% of the staff were ever provided formal training, showcasing significant gaps regarding awareness of risks and data protection duties.
2. Risky security behaviour- The staff has been frequently sharing credentials, reusing weak passwords and using personal devices with insecure file sharing methods. These unsafe practices can potentially leave patients and clients sensitive health-related data vulnerable.
3. Unprofessional Norms- The organisation operates with weak, unprofessional norms that prioritises speed and delivery over security. The approach of move fast fix later is embedded at the core of organisational practice undermining significance of cybersecurity in favour of productivity by leaders and employees.
4. Lack of accountability- The company lacks dedicated cybersecurity role; with the staff assuming that someone else will make the formal report or inform regarding the incident for resolutions. Thus, issues remain ignored or mishandled leaving critical weaknesses in escalation and solution.
5. Board capability gap- The Board recognise the significant threat related to cyber risk, but the relevant individuals possess limited cybersecurity literacy, thus they cannot deliver efficient governance and oversight. Unless this ability is enhanced, strategic decision-making techniques will be susceptible to blind spots.

Overall, these issues harm AI Med Innovations credibility and resilience, additionally if left unaddressed the organisation will be left exposed to regulatory, reputational, and financial threats.

Objectives

The program is designed on the basis of five primary objectives which include;

1. Embedding Cybersecurity Culture- The cybersecurity culture must be established as a shared cultural value across all level of the company including staff, contractors, interns, and leaders. This will facilitate in establishing the perception that cybersecurity an integral part of everyday work, rather than just an IT concern.
2. Enhanced phishing detection & Formal reporting- The staff’s capability to recognise and report the phishing attempts should be boosted. The goal is 30% increment in reporting accuracy facilitated with simulations, awareness campaigns, and feedback mechanisms within 12 months.
3. Achieving Universal Training Completion-Every member of the organisation must undergo cybersecurity induction and annual refresher training with 100% completion promoting a culture of continuous learning and accountability.
4. Strengthening Governance and Oversight- Another objective is to enhance Board and leadership involvement through cybersecurity briefing every quarter. This will clarify governance responsibilities and the board will make informed decisions on the basis of emerging threats.
5. Reducing Non-Compliance Behaviours- Lastly the goal is to decrease risks of irresponsible behaviours, including reuse of password, using personal resources, and sharing unsecured files by at least 40 % within the duration of the program.

Constraints and Staff Time Commitment

To successfully implement the program, there is a requirement of investing time and resources;

• Board & Executives- must commit around 6 hours annually for briefings and workshops.
• Managers and Team Leads- must commit 12 hours annually to deliver role specific training and oversight of responsibilities.
• Staff including interns and contactors must give 10 hours annually for modules, simulations and awareness campaigns.

To address constraints which include coordinating learning initiatives with operational demands and tool funding, the program introduces Micro-learning (10–15 minutes) modules, gamification, and hybrid delivery that caters security improvements and organization’s requirement of flexible and efficient performance.

Program Plan and Milestones (12 MONTHS) *

Key highlights:

• Phishing simulation and culture survey on a basic level.
• Induction is required for all personnel, including temporary staff and interns
• Targeted campaigns related to phishing, data handling and secure coding, every quarter
• Tasks-based gamified learning challenges with appreciation schemes
• Board cyber briefings on regular basis

Milestones:

• Month 1: Launching of program with baseline evaluation
• Month 2: implementation of fundamental training modules
• Month 3: Board briefings, with the appointment of departmental cyber heads.
• Month 6: By the mid of the program, progress report will be delivered with launching of advanced training modules.
• Month 9: A game-based Cyber Challenge on organisational level with introduction of targeted departmental workshops.
• Month12: In the final quarter, reviewing outcomes, completion of compliance audit, and presenting outcomes to the Board.

Expected Outcomes

Short term- Enhanced incident reporting with significant reduction in phishing clicks and raised awareness.

Long term- Establish an organisational culture of cybersecurity being integrated within the daily operations, mitigating the risk exposure building trust.

Metrics:

• Phishing click rate declined to less than 10%.
• Training completion rate of approx. 90% among employees
• 30 % improvement in accurate incident reporting.
• Culture survey scores increased by 25%

Intangible Benefits:

Establishing enhanced trust with the clients, confidence among investor, and better morale driven by recognition of safe practices.

Conclusion and Call to Action

Trust is crucial for the success and growth of AI Med Innovations. Currently, due to prevalent insecure behaviours, limited literacy and awareness, with governance gaps the trust is threatened. The developed Cybersecurity Culture, Awareness and Engagement Uplift Program provides practical and clarified approach to embed cybersecurity as a cultural power. If the program is approved and funded, it will not only facilitate the Board secure sensitive information of the organisation but also strengthen its image as a reliable business partner in the healthcare industry. The significance of immediate endorsement and implementation to ensure that AI Med Innovations operates within a relatively stable, regulatory, and competitive cyber space.