Styrelsen for Samfundssikkerhed, the Danish government agency responsible for cyber security, rates the threat from cybercrime against Danish organisations as very high. It has been at that level for several years, and most management teams have responded by buying technology: a better firewall, a better spam filter, cloud backup. Those are sensible investments. They only cover the part of an attack that a machine can stop.
The rest lands with an employee. An email that slipped through the filter. A call from someone who says he is from IT. An invoice with a new account number. In the annual 2025 Data Breach Investigations Report, a human element was part of around 60 percent of the breaches examined, and that share has stayed high year after year.
Where technology lets go
A spam filter assesses the sender, links and attachments. It cannot assess whether it is reasonable for the CFO to ask for an urgent transfer on a Friday afternoon. Only the employee who knows the CFO can make that call.
The same applies to two-step login. It protects the account until someone approves a request they did not start, because the phone kept buzzing. And encryption protects the file until it is sent to the wrong recipient. The Danish Data Protection Agency received 9,849 personal data breach notifications in 2025, the highest number since notification became mandatory in 2018, and the agency’s own review points to unintentional sharing with the wrong recipient as the most common type.
Security has become a management task
IT security in companies used to sit with the IT manager. Today, part of the responsibility formally sits with management. The GDPR requires appropriate organisational measures alongside the technical ones, and the Danish NIS2 Act, which took effect in 2025, requires management in the companies covered to make sure employees are trained and to take part themselves. We describe the requirements in more detail in our article on NIS2 and employee training.
For HR, this means security belongs in the same places as health and safety and personal data: in onboarding, in the annual plan and in the dialogue with managers. A new employee gets system access on day one. If the introduction to secure behaviour comes in month three, there have been three months without it.
What builds a security culture
Most employees know they should not click on suspicious links. Knowledge is rarely the problem. The problem is that the general rule does not help when the email appears to come from a customer they wrote to yesterday.
Three things make a difference in practice.
The examples need to look like everyday work. A warehouse employee with a handheld terminal and a legal secretary with access to client files meet different situations, and training works best when it uses their systems, their types of requests and the company’s own guidelines.
Training needs to be repeated in small pieces. A single course once a year is forgotten. Short modules spread across the year keep the topic alive without taking a full working day.
And reporting has to feel safe. If the person who reports a mistake is met with irritation, the rest of the department learns to stay quiet. The time from a click to a report often decides whether the incident becomes a note in the log or a week of downtime.
Phishing tests can have a place in that work, but they measure more than they teach. We have written about that trade-off in phishing test or awareness training.
How to begin
Start by finding out where employees actually make security choices during a week. Who approves payments? Who shares files with external parties? Who works from a customer’s site? That mapping can be done in a couple of hours with IT and a few managers, and it shows which groups need what. Sikkerdigital.dk offers a free security check (in Danish) that can serve as a starting point.
Training can then be built around those situations. At Grape, we develop cyber security e-learning that is quality-assured by subject-matter experts and developed by our learning designers. The scenarios can be adapted to your own working day, and the length is adapted to your needs. The programme covers nine themes, from scam messages and passwords to data sharing and security breaches, and you choose which ones are relevant for which employees. The Inforevision case shows how a ready-made course was adapted to the company’s visual identity and rolled out in a few days.
If you would like to talk about where you stand today, you are welcome to contact us.
