Cybersecurity Culture Uplift Board Paper – Executive Proposal & Program Plan

Executive Summary

This proposal presents a 12-month program to uplift cybersecurity culture, education, and engagement at AI Med Innovations, a fast-growing med-tech startup. The initiative aims to embed the secure mindset throughout the organisation by addressing key behavioural and operational weaknesses that have been identified in recent assessments. The program balances cost-effective education, leadership engagement, and ongoing measurement to reduce cyber risk and protect sensitive healthcare data, and supports AI Med Innovations' commitment to trust and innovation in digital health solutions, regulatory compliance, and robust protection against the newly emerging cyber threats in a rapidly evolving healthcare environment

Background

According to AI Med Innovations (2025), the company rapidly delivers affordable digital health solutions to small clinics, research groups, and community healthcare providers with a team focused on speed and agility. However, the current cybersecurity practices are fragile, with poor awareness, informal policies, as well as unsafe behaviours prevalent across the teams, including developers, marketing, and administration. The company’s growth and expanding client base increase the risks of data protection. The Board also acknowledges gaps in cybersecurity knowledge and governance that need to be addressed in order to maintain trust and ensure compliance in healthcare environments. Rising threats like IoT medical device breaches and vulnerabilities in electronic health records make security measures urgent. As highlighted by Ewoh & Vartiainen (2024), these cyberattacks can cause significant data breaches in digital health information systems, directly threatening patient safety and privacy, and highlighting the critical need for a robust cybersecurity culture and engagement program.

Recommendation

It is recommended to implement a structured cybersecurity culture and awareness program spanning 12 months that focuses on leadership engagement, targeted training, behaviour change, and policy enforcement. The program will integrate microlearning, phishing simulations, incident reporting improvements, and clear cybersecurity responsibilities with measurable outcomes. This approach will empower all the employees, contractors, and interns to contribute actively to protect organisational assets and data. As noted by Armas & Taherdoost (2025), a dedicated cybersecurity awareness and training framework that incorporates practical components such as phishing campaigns, complementary activities to encourage behaviour change, and the promotion of a cybersecurity culture, empowers users, aligns with organizational objectives, and creates a continuous improvement process in order to strengthen the resilience against cyber threats.

Key Challenges Identified

According to AI Med Innovations (2025), the organisation faces several critical cybersecurity challenges, including a leadership and Board with limited cybersecurity literacy and unclear accountability, which usually hinders effective governance. The organisation’s culture gives priority to speed over security, resulting in widespread risky behaviours such as password reuse, credential sharing, and the use of unsecured personal devices across teams. Formal cybersecurity training is minimal, and enforcement of the policies is weak. Furthermore, incident communication and reporting are also ineffective, with many staff disengaged from their respective cyber risk responsibilities. These deficiencies expose the organisation to significant vulnerabilities, compromising its data protection and trust within a sensitive healthcare environment. As highlighted by Djenna et al. (2021), limited visibility across cyberspace, combined with a lack of comprehensive and robust strategies, poses significant challenges to effectively oversee and manage the cybersecurity of critical infrastructure.

Objectives

• To develop a culture of pervasive cybersecurity that will fit the strategic mission of AI Med Innovations and the organizational risk tolerance.
• Enhance employee knowledge and awareness of cyber risks to enable effective mitigation across all functional teams.
• Define and formalize roles, responsibilities, and reporting structures to ensure consistent management of cybersecurity incidents.
• Implement quantifiable changes in risky behaviours, as well as exposure to phishing attacks, through targeted interventions.
• Encourage and improve the leadership-driven governance to support the implementation of resilient and sustainable cybersecurity practices.

Constraints and Staff Time Commitment

The delivery of the cybersecurity culture and awareness program faces many constraints, which include limited staff availability because of fast-paced development cycles, budgetary limitations inherent to a startup, and the need to balance the innovation with security priorities. To accommodate these constraints, the program incorporates flexible, bite-sized training modules, that are complemented by virtual workshops, training sessions, and integrated communications. The estimated average staff time commitment is approximately 2–3 hours per quarter, distributed across the stakeholders, including leadership briefings, team sessions, as well as self-paced learning activities.

Program Plan and Milestones (12 MONTHS) *

Key highlights:

• Comprehensive baseline cybersecurity culture assessment and leadership engagement launch.
• Regular education cycles combining microlearning and simulated phishing exercises.
• Formal policy rollout and enforcement with the contractor and intern onboarding improvements.
• Recognition and reward system for promoting positive behaviours and mature reporting culture.

Key milestones:

• Month 1: Kickoff with leadership and board workshops, baseline survey.
• Month 2: Analyze the results of baseline survey, develop targeted microlearning content, launch initial communications, and conduct intro workshops.
• Month 3: Launch awareness campaigns and microlearning modules.
• Month 6: First phishing simulation and policy formalisation.
• Month 9: Tabletop incident response exercise and reward program launch.
• Month 12: Final culture survey, program evaluation, and continuous improvement plan.

Expected Outcomes

Short-term: Immediate increase in cybersecurity awareness and incident reporting accuracy.

Long-term: Sustained security-conscious culture that will support organisational growth and trust preservation.
Measurable metrics: Target 50% reduction in password reuse and credential sharing, while phishing detection success improved to 80%.
Intangible benefits: Enhanced employee confidence in security practices, improved client and investor trust.

Conclusion and Call to Action

Strengthening AI Med Innovations’ cybersecurity culture is important for protecting sensitive health data, ensuring regulatory compliance, as well as maintaining the reputation of the company as a trusted provider of innovative digital health solutions. The proposed program provides a well-structured, cost-effective approach in order to increase employee awareness, embed secure behaviours across all team members, and empower the workforce to act as the organisation’s first line of defence against evolving cyber threats. However, success depends on the Board’s endorsement and active leadership involvement, which will be helpful in promoting accountability, modelling desired behaviours, and ensuring that the cybersecurity strategy is fully aligned with organisational objectives, its risk capacity, and long-term growth priorities.